FIPS Compliance
Run the Curity Identity Server in FIPS mode so that every cryptographic operation is performed by a FIPS 140-3-validated module using only approved algorithms.
The Federal Information Processing Standards (FIPS) are United States federal standards for computer systems. FIPS 140-3 defines the security requirements for cryptographic modules and is a common procurement requirement for federal agencies, for programs such as FedRAMP, and for other regulated environments.
When FIPS mode is enabled, the Curity Identity Server routes all cryptographic operations through a FIPS 140-3-validated module and restricts configuration to an approved set of algorithms. Cryptography is provided by a FIPS-validated cryptographic provider running in approved-only mode, backed by the FIPS-validated OpenSSL of the underlying operating system. To guarantee this environment, Curity Identity Server is distributed for FIPS as a dedicated Docker image, and running in FIPS mode is supported only from that image. The server rejects non-approved algorithms when configuration is applied, so a running instance only ever performs approved cryptography.
FIPS mode is a deployment-wide choice made when the server starts, not a setting you toggle at runtime on an existing environment. Only FIPS-approved algorithms are permitted, so configurations that rely on non-approved cryptography — such as bcrypt or phpass password hashing — are rejected. Plan for FIPS from the start of a deployment rather than migrating an existing one.
Learn how to run and configure the Curity Identity Server in FIPS mode:
Running in FIPS Mode
The FIPS Docker image, the —fips-mode startup flag, and how to confirm FIPS mode is active.
FIPS-Approved Cryptography
The keystore format, password-hashing algorithms, keys, TLS, and token encryption permitted in FIPS mode.
Importing FIPS-Compliant Keystores
Import private keys in FIPS mode, where PKCS#12 is not supported.