FIPS mode

Starting with version 2.12, Horizon is distributed in two flavors:

  • the standard flavor, used by default;

  • the FIPS flavor, in which all cryptographic operations are performed by the BouncyCastle FIPS provider (bc-fips) running in approved-only mode, and TLS is handled by the BouncyCastle JSSE provider in FIPS mode.

The FIPS flavor is intended for environments subject to FIPS constraints. Both flavors are configured the same way, and the FIPS flavor is selected by installing its dedicated artifacts.

Artifacts

The FIPS flavor of each component is published under its own name, suffixed with -fips:

Component Standard FIPS

Horizon

RPM / DEB package: horizon

RPM / DEB package: horizon-fips

Docker image: registry.evertrust.io/horizon:<version>

Docker image: registry.evertrust.io/horizon:<version>-fips

Helm chart: default values

Helm chart: image.flavor: fips

Tinkey

RPM / DEB package: tinkey

RPM / DEB package: tinkey-fips

Docker image: registry.evertrust.io/tinkey:latest

Docker image: registry.evertrust.io/tinkey:latest-fips

Horizon Migration Tool

RPM / DEB package: horizon-migration

RPM / DEB package: horizon-migration-fips

Docker image: registry.evertrust.io/horizon-migration:latest

Docker image: registry.evertrust.io/horizon-migration:latest-fips

The FIPS packages are published in the same repositories as the standard ones, and install to the same paths (for instance /opt/horizon). Only the package name differs.

Each FIPS artifact can be used on its own. If your environment is subject to FIPS constraints, use the FIPS flavor of every component that falls under these constraints.

Installation

  • RPM

  • Debian

  • Kubernetes

  • Docker

Follow the installation procedure and install the horizon-fips package instead of horizon:

# yum install horizon-fips

Follow the installation procedure and install the horizon-fips package instead of horizon:

# sudo apt install horizon-fips

Set the image flavor in your values.yaml file. The chart appends it to the image tag:

image:
  flavor: fips

The upgrade jobs use the Horizon Migration Tool image, whose tag must also carry the -fips suffix:

upgrade:
  image:
    tag: <migration tool version>-fips

Use the image tag suffixed with -fips:

$ docker pull registry.evertrust.io/horizon:<version>-fips

Specific behavior

In FIPS mode, the following applies:

  • PKCS#12 files must use the AES_STRONG encryption level (AES-256-CBC with PBKDF2 HMAC-SHA256) and be integrity protected with PBMAC1.

  • Key store passwords must be at least 14 characters long.

  • SCEP uses OAEP encryption instead of PKCS 1.5

  • By default, bc-fips refuses to use the same RSA key both for encryption and for signature. When a SCEP RA key is used to both decrypt requests and sign responses, add -Dorg.bouncycastle.rsa.allow_multi_use=true to the JVM options (JAVA_OPTS).

  • CRMP profiles cannot be created since they require legacy encryption.

  • RSA 1024 and SHA-1 are disabled.

  • No PQC support outside of discovery.