Content

Summary

• IBM Java v8.0.8.20 onwards has dropped support for FIPS 140-2
• IBM Java v8.0.8.30 onwards has added support for FIPS 140-3 but is not supported in the product using Java v8.0.8.30 onwards
• IBM Sterling B2B Integrator and IBM Sterling File Gateway will only support FIPS 140-3 functionality on product versions using Java 17, i.e. v6.2.1.0 onwards
• See announcements:
  • Statement of direction: FIPS 140-2 deprecation and FIPS 140-3 support
  • Statement of direction: migration and upgrade paths for FIPS 140-2 end of support

IBM Java 8 & FIPS 140-3

IBM Java has announced FIPS 140-3 support for Java v8.0.8.30 or later:

https://www.ibm.com/docs/en/sdk-java-technology/8?topic=guide-fips-140-3

“The IBMJCEPlusFIPS cryptography module was certified for FIPS 140-3 by NIST in August 2024 and is supported on most platforms (as mentioned in the Operational environments section) for production use in IBM SDK for Java 8.0.8.30 or later.”

Sterling B2B Integrator & Sterling File Gateway support of FIPS 140-3

IBM Java v8.0.8.20 onwards removed the historical RSA modules required for FIPS 140-2 certification. Java 8 versions newer than Java v8.0.8.15 are no longer certified for FIPS 140-2.

Sterling B2B Integrator & Sterling File Gateway v6.1.2.5/6.2.0.2 (and older) have historical support for FIPS 140-2 only. No updates to FIPS 140-2 support are possible.

FIPS 140-3 on Java 8 has not been tested on any Sterling B2B Integrator/Sterling File Gateway v6.2.0.x version to date and there are no plans to support it in the field. FIPS 140-3 support will only be provided on Sterling B2B Integrator/Sterling File Gateway versions using Java 17, v6.2.1.0 onwards.

If a client needs FIPS support:

• Use Sterling B2B Integrator/Sterling File Gateway v6.1.2.5/6.2.0.2 or older with FIPS 140-2 support until able to upgrade to v6.2.1.0, which provides FIPS 140-3 support
• Sterling B2B Integrator/Sterling File Gateway v6.2.1.0 ships with a custom FIPS profile out-of-the-box that allows FIPS 140-2 level ciphers to aid clients in the transition to the stronger 140-3 compliant ciphers
• There is no support for FIPS 140-3 on any version older than v6.2.1.0
• There is no support for FIPS 140-2 on any version of v6.2.0.3 onwards or v6.1.2.6 onwards because NIST will not certify that level of Java 8

For assistance, contact IBM Support.