[Feature Request] Support for FIPS 140-2 enforced mode.

[thunderstumpges]

In some customer service contracts (especially Government contracts), there is a requirement to run all services in FIPS 140-2 compliant/enforced mode.

Elasticsearch supports this currently in their xpack security plugin.

We, and I imagine others could benefit greatly with the ability to run OpenSearch in a FIPS 140-2 enforced mode JVM.

I see there was also an OpenDistro community post asking for this feature as well.

[saratvemulapalli]

Thanks for reaching out.
I'll move this to our security plugin team.

Also @setiah probably you might interested!

[CEHENKLE]

@davidlago You might be interested in this as well :)

[tdurden82]

FIPS 140-2 Mode would be an excellent feature

[setiah]

A related discussion around making the crypto provider in security plugin configurable. https://github.com/opensearch-project/OpenSearch/issues/1487 As part of this, it should also enable users to provide a FIPS compliant provider.

[dblock]

Please consider how/whether/when this will work on Windows, which has its own world of cryptographic providers.

[bhupendra-mskhatri]

@davidlago any timeline/roadmap on FIPS compliance for opensearch on windows?
Our customers want our application to be FIPS compliant by mid this year and since we use opensearch we would like to see this soon.

[davidlago]

Thanks for the interest, @bhupendra-mskhatri! We are not actively working on this issue at the moment, though it is a contribution we'd most definitely welcome.

[bhupendra-mskhatri]

Thankyou @davidlago for your response.
Can you or someone from your team give a basic idea of what changes might be required in opensearch to make it FIPS compliant. This would help me understand the contribution estimate.

[stephen-crawford]

Hi @bhupendra-mskhatri, I tried to gather some information for you to be able to gauge the scope.

For starters, we are going to have to rework the use of Bouncy Castle. If you look at their website you can see that while they do have FIPS certified APIs for Java, they are only certified for 1.7, 1.8, and 1.11. This means that the 2.x line and main which supports 1.17 will have to be run with 1.11 in order to be compliant. This is probably acceptable if a little bit confusing (there will be OpenSearch versions that are only compliant in one version configuration).

You can see the Bouncy Castle FIPS versions here and some implementation details here. In effect, you would minimally need to replace any non-compliant algorithms with their certified counterparts from one of the linked Bouncy Castle API versions and make sure that the software then met the guidelines of the documentation.

[rathiyajiv]

Thanks, @scrawfor99.
Our application bundles OpenSearch as a repository to persist some related settings. In order to make our application FIPS compliant we are running this whole setup under the FIPS setup.

OpenSearch crashes when it runs with FIPS on the mode by saying -

Caused by: java.io.IOException: DerInputStream.getLength(): lengthTag=109, too big.
at sun.security.util.DerInputStream.getLength(DerInputStream.java:606) ~[?:?]
at sun.security.util.DerValue.init(DerValue.java:390) ~[?:?]
at sun.security.util.DerValue.(DerValue.java:331) ~[?:?]
at sun.security.util.DerValue.(DerValue.java:344) ~[?:?]
at sun.security.pkcs12.PKCS12KeyStore.engineLoad(PKCS12KeyStore.java:1996) ~[?:?]
at java.security.KeyStore.load(KeyStore.java:1479) ~[?:?]
at sun.security.ssl.TrustStoreManager$TrustAnchorManager.loadKeyStore(TrustStoreManager.java:365) ~[?:?]
at sun.security.ssl.TrustStoreManager$TrustAnchorManager.getTrustedCerts(TrustStoreManager.java:313) ~[?:?]
at sun.security.ssl.TrustStoreManager.getTrustedCerts(TrustStoreManager.java:55) ~[?:?]
at sun.security.ssl.TrustManagerFactoryImpl.engineInit(TrustManagerFactoryImpl.java:49) ~[?:?]
at javax.net.ssl.TrustManagerFactory.init(TrustManagerFactory.java:278) ~[?:?]
at org.elasticsearch.common.ssl.KeyStoreUtil.createTrustManager(KeyStoreUtil.java:151) ~[?:?]
at org.elasticsearch.common.ssl.DefaultJdkTrustConfig.createTrustManager(DefaultJdkTrustConfig.java:68) ~[?:?]
at org.elasticsearch.common.ssl.SslConfiguration.createSslContext(SslConfiguration.java:136) ~[?:?]
at org.elasticsearch.index.reindex.ReindexSslConfig.reload(ReindexSslConfig.java:145) ~[?:?]
at org.elasticsearch.index.reindex.ReindexSslConfig.(ReindexSslConfig.java:115) ~[?:?]
at org.elasticsearch.index.reindex.ReindexPlugin.createComponents(ReindexPlugin.java:91) ~[?:?]
at org.elasticsearch.node.Node.lambda$new$15(Node.java:553) ~[elasticsearch-7.10.2.jar:7.10.2]
at java.util.stream.ReferencePipeline$7$1.accept(ReferencePipeline.java:271) ~[?:?]
at java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1655) ~[?:?]
at java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:484) ~[?:?]
at java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:474) ~[?:?]
at java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:913) ~[?:?]
at java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234) ~[?:?]
at java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:578) ~[?:?]
at org.elasticsearch.node.Node.(Node.java:557) ~[elasticsearch-7.10.2.jar:7.10.2]
at org.elasticsearch.node.Node.(Node.java:289) ~[elasticsearch-7.10.2.jar:7.10.2]
at org.elasticsearch.bootstrap.Bootstrap$5.(Bootstrap.java:227) ~[elasticsearch-7.10.2.jar:0-SNAPSHOT]
at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:227) ~[elasticsearch-7.10.2.jar:0-SNAPSHOT]
at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:393) ~[elasticsearch-7.10.2.jar:0-SNAPSHOT]
at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:170) ~[elasticsearch-7.10.2.jar:0-SNAPSHOT]
... 7 more

** @davidlago @saratvemulapalli, Please if anyone came across with similar situation?**

FIPS settings turned on the windows box -
OS settings

1. In Control Panel, click Administrative Tools, and then double-click Local Security Policy.
2. In Security Settings, expand Local Policies and then click Security Options.
3. Under Policy in the right pane, double-click System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing, and then click enable.

Java settings
Update the precedence of Sun’s crypto modules JCE & JSSE to 1 & 2 under java

jdk-11.0.11.9-hotspot\conf\security\java.security
security.provider.1=SunJCE
security.provider.2=SunJSSE
.
.
security.provider.3=SUN

[peternied]

@rathiyajiv That error message is based on the certificate being loaded, is it possible the cert isn't in PKCS12 format?

Relevant StackOverflow question/answers https://stackoverflow.com/a/57683701/533057

[rathiyajiv]

@rathiyajiv That error message is based on the certificate being loaded, is it possible the cert isn't in PKCS12 format?

Relevant StackOverflow question/answers https://stackoverflow.com/a/57683701/533057

Thanks @peternied, the observation here is an error occurs only when FIPS settings are on. Does PKCS12 format a must for FIPS mode from the opeansearch perspective?