D Oracle Advanced Security FIPS 140 Settings

D.2.1 About the FIPS 140-2 Settings

The cryptographic libraries for SSL included in Oracle Database 10g are designed to meet FIPS 140-2 Level 2 certification. Oracle Advanced Security makes use of these cryptographic libraries for SSL authentication.

The instructions in this appendix apply to Oracle Database Release 11.2.0.4 and later. For more information about upgrading to Release 11.2.0.4, visit the following Oracle Technology Network site:

http://www.oracle.com/technetwork/database/enterprise-edition/downloads/index-092322.html

D.2.2 Configuring the SSLFIPS_140 Parameter

Oracle Advanced Security SSL adapter can be configured to run in FIPS mode by setting the SSLFIPS_140 parameter to TRUE in the fips.ora file.

SSLFIPS_140=TRUE

This parameter is set to FALSE by default. It must be set to TRUE on both the client and the server for FIPS mode operation.

Make sure that the fips.ora file is either located in the $ORACLE_HOME/ldap/admin directory, or is pointed to by the FIPS_HOME environment variable. This procedure can be repeated in any Oracle home for any database server or client.

D.2.3 Selecting Cipher Suites

A cipher suite is a set of authentication, encryption and data integrity algorithms used for exchanging messages between network nodes. During an SSL handshake, for example, the two nodes negotiate to see as to which cipher suite they will use when transmitting messages back and forth.

Only the following cipher suites are approved for FIPS validation:

• SSL_DH_anon_WITH_3DES_EDE_CBC_SHA

• SSL_RSA_WITH_AES_256_CBC_SHA

• SSL_RSA_WITH_AES_128_CBC_SHA

• SSL_RSA_WITH_3DES_EDE_CBC_SHA

Oracle Advanced Security SSL cipher suites are automatically set to FIPS approved cipher suites. If you wish to configure specific cipher suites, you can do so by editing the SSL_CIPHER_SUITES parameter in the sqlnet.ora or the listener.ora file.

SSL_CIPHER_SUITES=(SSL_cipher_suite1[,SSL_cipher_suite2[,..]])

You can also use Oracle Net Manager to set this parameter on the server and the client.

D.2.4 Post-Installation Checks

After installation, the following permissions must be verified in the operating system:

• Execute permissions must be set on all Oracle executable files so as to prevent execution of Oracle Cryptographic Libraries by users who are unauthorized to do so in accordance with the system security policy.

• Read and write permissions must be set on all Oracle executable files so as to prevent accidental or deliberate reading or modification of Oracle Cryptographic Libraries by any user.

To comply with FIPS 140-2 Level 2 requirements, the security policy must include procedures to prevent unauthorized users from reading, modifying or executing Oracle Cryptographic Libraries processes and the memory they are using in the operating system.

D.2.5 Verifying FIPS Connections

To check if FIPS mode is enabled, tracing can be added to the sqlnet.ora file. FIPS self-test messages can be found in the trace file. Add the following lines to sqlnet.ora to enable tracing:

trace_directory_server=trace_dir
trace_file_server=trace_file
trace_level_server=trace_level

For example:

trace_directory=/private/oracle/owm
trace_file_server=fips_trace.trc
trace_level_server=6

Trace level 6 is the minimum trace level required to check the results of the FIPS self-tests.

D.3.1 About the FIPS 140-1 Settings

The Oracle Database FIP 140-1 implementation has been validated under Federal Information Processing Standard (FIPS) 140-1 at the Level 2 security level. This appendix describes the formal configuration required to comply with the FIPS 140-1 standard. Refer to the NIST Cryptographic Modules Validation list at the following Web site address:

http://csrc.nist.gov/cryptval/140-1/1401val.htm

D.3.2 sqlnet.ora FIPS 140-1 Configuration Parameters

This appendix contains information on the Oracle Advanced Security parameters required in the sqlnet.ora files to ensure that any connections created between a client and server are encrypted under the control of the server.

Configuration parameters are contained in the sqlnet.ora file that is held locally for each of the client and server processes. The protection placed on these files should be equivalent to the level of a DBA.

The following configuration parameters are described in this appendix:

• ENCRYPTION_SERVER

• ENCRYPTION_CLIENT

• ENCRYPTION_TYPES_SERVER

• ENCRYPTION_TYPES_CLIENT

• FIPS_140

SQLNET.ENCRYPTION_SERVER=REQUIRED

SQLNET.ENCRYPTION_CLIENT=(ACCEPTED|REQUESTED|REQUIRED)

SQLNET.ENCRYPTION_TYPES_SERVER=(DES,DES40)

SQLNET.ENCRYPTION_TYPES_CLIENT=(DES,DES40)

SQLNET.FIPS_140=TRUE

D.3.3 Post Installation Checks

After the installation, the following permissions must be verified in the operating system:

• Execute permissions must be set on all Oracle Advanced Security executable files so as to prevent execution of Oracle Advanced Security by users who are unauthorized to do so in accordance with the system security policy.

• Read and write permissions must be set on all executable files so as to prevent accidental or deliberate reading or modification of Oracle Advanced Security files by any user.

To comply with FIPS 140-1 Level 2 requirements, the security policy must include procedures to prevent unauthorized users from reading or modifying Oracle Advanced Security processes and the memory they are using in the operating system.

D.3.4 Status Information

Status information for Oracle Advanced Security is available after the connection has been established. The information is contained in the RDBMS virtual table v$session_connect_info.

Running the query SELECT * from V$SESSION_CONNECT_INFO displays all of the product banner information for the active connection. Table D-1 shows an example of a connection configuration where the DES encryption data integrity is defined:

D.3.5 Physical Security

To comply with FIPS 140-1 Level 2 requirements, tamper-evident seals must be applied to the cover of each computer to ensure that removal of the cover is detectable.