FIPS Compliance
Run the Curity Identity Server in FIPS mode so that every cryptographic operation is performed by a FIPS 140-3-validated module using only approved algorithms.
The Federal Information Processing Standards (FIPS) are United States federal standards for computer systems. FIPS 140-3 defines the security requirements for cryptographic modules and is a common procurement requirement for federal agencies, for programs such as FedRAMP, and for other regulated environments.
When FIPS mode is enabled, the Curity Identity Server routes all cryptographic operations through a FIPS 140-3-validated module and restricts configuration to an approved set of algorithms. Cryptography is provided by a FIPS-validated cryptographic provider running in approved-only mode, backed by the FIPS-validated OpenSSL of the underlying operating system. To guarantee this environment, Curity Identity Server is distributed for FIPS as a dedicated Docker image, and running in FIPS mode is supported only from that image. The server rejects non-approved algorithms when configuration is applied, so a running instance only ever performs approved cryptography.
FIPS mode is a deployment-wide choice made when the server starts, not a setting you toggle at runtime on an existing environment. A FIPS deployment and a non-FIPS deployment are separate environments: switching between the two modes is not supported in either direction, and there is no migration path from one to the other. Plan for FIPS from the start of a deployment.
Learn how to run and configure the Curity Identity Server in FIPS mode:
Running in FIPS Mode
The FIPS Docker image, the —fips-mode startup flag, and how to confirm FIPS mode is active.
FIPS-Approved Cryptography
The keystore format, password-hashing algorithms, keys, TLS, and token encryption permitted in FIPS mode.
Importing FIPS-Compliant Keystores
Import private keys in FIPS mode, where PKCS#12 is not supported.