[QUERY] Does Azure Java SDK support FIPS by default

[nnajwaa]

Query/Question

The default SSL/TLS library for Azure Java SDK http clients is the Tomcat-native Boring SSL library (dependency in code, official documentation documentation)

The Tomcat-native Boring SSL library is not FIPS validated (source)

I have found conflicting information stating (source query) :

We acquire our crypto instances via Java's cryptographic framework, which can be set by the application developer to provide whatever implementation is desired. You as the end-developer get to choose what providers are available to the JVM in the first place, and thus can ensure only fips-compliant providers are given.

^ This seems to point to the Azure Java SDK using by default the JVM crypto.

I'm seeking confirmation on whether the HttpClient is automatically FIPS compliant as long as the underlying JVM only exposes FIPS compliant providers.

Thanks!

[github-actions]

Thank you for your feedback. Tagging and routing to the team member best able to assist.

[nnajwaa]

Hi @alzimmermsft 👋🏼 I'd appreciate it if you could have a look at this. Thanks!

[alzimmermsft]

Thanks for asking this question @nnajwaa. I'll need to investigate this further.

Few quick things though:

• Netty may have an ability to enable FIPS compliance in Tomcat-native Boring SSL (Request for FIPS-Validated netty-tcnative release netty/netty-tcnative#799). Though I haven't really looked into what this does or means.
• Another option is to exclude Tomcat-native Boring SSL from your application and provide another SSL provider which is FIPS compliant (similar to what the conflicting information you've included).