The National Institute of Standards and Technology (NIST) is the US federal technology agency that works with industry to develop and apply technology, measurements, and standards. One of the standards published by NIST is the Federal Information Processing Standard Security Requirements for Cryptographic Modules, referred to as FIPS 140-2. FIPS 140-2 provides a standard that can be required by organizations who specify that cryptographic-based security systems are to be used to provide protection for sensitive or valuable data.

z/OS PKCS #11 cryptography is designed to meet FIPS 140-2 Level 1 criteria, and can be configured to operate in compliance with FIPS 140-2 specifications. Applications that need to comply with the FIPS 140-2 standard can therefore use the z/OS PKCS #11 services in a way that allows only the cryptographic algorithms (including key sizes) approved by the standard and restricts access to the algorithms that are not approved. There are two modes of FIPS operation:

• The services can be configured so that all z/OS PKCS #11 applications are forced to comply with the FIPS 140-2 standard. This is called FIPS standard mode.
• For installations where only certain z/OS PKCS #11 applications need to comply with the FIPS 140-2 standard, the services can be configured so that only the necessary applications are restricted from using the non-approved algorithms and key sizes, while other applications are not. This is called FIPS compatibility mode.

You can also use FIPS compatibility mode to test individual applications to ensure FIPS compliance before switching to FIPS standard mode.

ICSF installation options are described in the z/OS Cryptographic Services ICSF System Programmer’s Guide. The installation option FIPSMODE indicates one of the following:

• the z/OS PKCS #11 services will operate in FIPS standard mode. The installation option to specify this is FIPSMODE(YES, FAIL(fail-option)) and is described in more detail in Requiring FIPS 140-2 compliance from all z/OS PKCS #11 applications.
• the z/OS PKCS #11 services will operate in FIPS compatibility mode. The installation option to specify this is FIPSMODE(COMPAT, FAIL(fail-option)). When operating in FIPS compatibility mode, it is expected that further specifications will be made to identify which applications must comply with the FIPS 140-2 standard, and which applications do not need to comply. These further specifications can be made:
  • at the PKCS #11 token and application level, using FIPSEXEMPT.token-name resource profiles in the CRYPTOZ class.
  • within applications themselves for individual keys. When an application creates a key, the application can specify that the key must be used in a FIPS 140-2 compliant fashion. The application can specify this by setting the Boolean key attribute CKA_IBM_FIPS140 to TRUE.
  The FIPSMODE(COMPAT, FAIL(fail-option)) installation option, FIPSEXEMPT.token-name resource profiles, and the CKA_IBM_FIPS140 key attribute, are described in more detail in Requiring FIPS 140-2 compliance from select z/OS PKCS #11 applications.
• no FIPS 140-2 compliance is required by any application. This is the default behavior if the FIPSMODE installation option is not used, but can be set explicitly using the FIPSMODE(NO, FAIL(fail-option)) installation option.

If any z/OS PKCS #11 application intends to use the services in compliance with the FIPS 140-2 standard, then, in accordance with that standard, the integrity of the load module containing the z/OS PKCS #11 services must be checked when ICSF is started. This load module is digitally signed, and, in order for applications using its services to be FIPS 140-2 compliant, the signature must be verified when ICSF is started. For more information, refer to Requiring signature verification for ICSF module CSFINPV2.

If any application will use PKCS #11 objects for AES Galois/Counter Mode (GCM) encryption or GMAC generation, and will have ICSF generate the initialization vectors, then you need to set ECVTSPLX or CVTSNAME to a unique value. Refer to z/OS Cryptographic Services ICSF System Programmer’s Guide for more information.