The Federal Information Processing Standard (FIPS) standard, 140-2, is a U.S. government standard that defines cryptographic module security requirements.

The FIPS 140-2 cryptographic libraries are designed to protect data at rest and in transit over the network.

Oracle Database uses these cryptographic libraries for Secure Sockets Layer (SSL), Transparent Data Encryption (TDE), and DBMS_CRYPTO PL/SQL package.

To verify the current status of the certification, you can find information at the Computer Security Resource Center (CSRC) Web site address from the National Institute of Standards and Technology:

http://csrc.nist.gov/groups/STM/cmvp/validation.html

You can find information specific to FIPS by searching for Validated FIPS 140 Cryptographic Modules. The security policy, which is available on this site upon successful certification, includes requirements for secure configuration of the host operating system.

The Oracle Database FIPS settings are meant to enforce the use of FIPS-approved algorithms for the Oracle database only. The use of third-party vendor software with Oracle Database running in FIPS mode must use FIPS-approved algorithms or else the vendor software will encounter failures.

The DBFIPS_140 initialization parameter configures FIPS mode.

1. To configure Transparent Data Encryption and the DBMS_CRYPTO PL/SQL package program units to run in FIPS mode, set the DBFIPS_140 initialization parameter to TRUE.
   The effect of this parameter depends on the platform.
2. Restart the database.

The SSLFIPS_140 parameter configures Secure Sockets Layer (SSL).

• Configuring the SSLFIPS_140 and SSLFIPS_LIB Parameters for Secure Sockets Layer
  To configure FIPS 140-2 for SSL, you must set the SSLFIPS_140 parameter. If you are using the Oracle Instant Client, then you must set the SSLFIPS_LIB parameter as well.
• Approved SSL Cipher Suites for FIPS 140-2
  A cipher suite is a set of authentication, encryption, and data integrity algorithms that exchange messages between network nodes.

After you configure the FIPS 140-2 settings, you must verify permissions in the operating system.

The permissions are as follows:

• Set execute permissions on all Oracle executable files to prevent the execution of Oracle Cryptographic Libraries by users who are unauthorized to do so, in accordance with the system security policy.

• Set read and write permissions on all Oracle executable files to prevent accidental or deliberate reading or modification of Oracle Cryptographic Libraries by any user.

To comply with FIPS 140-2 Level 2 requirements, in the security policy, include procedures to prevent unauthorized users from reading, modifying or executing Oracle Cryptographic Libraries processes and the memory they are using in the operating system.

To check if FIPS mode is enabled for SSL, you can enable tracing in the sqlnet.ora file.

1. Add the following lines to sqlnet.ora to enable tracing:

   trace_directory_server=trace_directory
   trace_file_server=trace_file
   trace_level_server=trace_level
   

   For example:

   trace_directory=/private/oracle/owm
   trace_file_server=fips_trace.trc
   trace_level_server=6
   

2. To check if FIPS mode is enabled for TDE and DBMS_CRYPTO, log into SQL*Plus and run the following command:

   SHOW PARAMETER DBFIPS_140