Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

FIPS 140-2: Stay compliant and secure with Canonical

This article was last updated 1 year ago.

FIPS 140-2 is a set of publicly announced cryptographic standards developed by the National Institute of Standards and Technology. It is an essential part of FEDRamp requirements for many governmental agencies in the US and Canada, as well as their business partners from all around the world. Furthermore, as a well established and verified security standard, an increasing number of large companies and financial institutions are asking for FIPS compliance. 

Yet, FIPS certification process introduces challenges that could impact your security. Ubuntu lets you choose the way to implement FIPS-certified cryptographic modules with two distinct FIPS alternatives to choose from to overcome those challenges.

FIPS 140-2 certification vs CVE patching

FIPS 140-2 is a great way to assure that the best practices in cryptography are met. The rules that each organisation needs to follow to achieve the FIPS 140-2 certification are very strict. Each component needs to be designed, documented, tested and then validated by the NIST Testing Laboratory. Once a component becomes certified, it cannot be further modified without requiring a re-certification. This individual module validation can take weeks, and so the overall process can easily stretch to over 6 months. 

The apparent drawback of that situation appears when a new security patch becomes available. 

Imagine that a new critical CVE (Common Vulnerability and Exposure) was discovered in the OpenSSH module, but thankfully there is a USN (Ubuntu Security Notice) available to fix it. With a security fix applied  – the module will change and hence will no longer be certified; without it – the module’s security can be compromised by an exploitable vulnerability. 

FIPS Certified or FIPS Compliant

You might be wondering which Ubuntu FIPS version should be used in your organisation. That depends. If you work for a federal government department that collects, stores, transfers and shares sensitive but unclassified information, it’s likely that you’re required to use FIPS Certified modules without any modifications. In other cases – we recommend using FIPS Certified modules that include all security patches. We call it Ubuntu FIPS Compliant

Maintaining FIPS Certified modules security

To keep your FIPS Certified Ubuntu secure we will re-certify all modules every year.

Today, Ubuntu 18.04 LTS and 16.04 LTS has certifications for 5 distinct modules:  

Ubuntu 18.04 LTS

ComponentDescriptionVersionCMVP Certificate
Linux kernel (generic)The Linux kernel cryptographic library4.15.03647
OpenSSLGeneral purpose cryptographic library that includes TLS implementation1.1.13622
OpenSSH clientSSH server application for operating systems7.9p13633
OpenSSH serverSSH client application for operating systems7.9p13632
StrongSWANIPSec based VPN solution library5.6.23648

Ubuntu 16.04 LTS

ComponentDescriptionVersionCMVP Certificate
Linux kernel (generic)The Linux kernel cryptographic library4.4.0.10022962
OpenSSLGeneral purpose cryptographic library that includes TLS implementation1.0.2g2888
OpenSSH clientSSH client application for operating systems7.2p22907
OpenSSH serverSSH server application for operating systems7.2p22906
StrongSWANIPSec based VPN solution library5.3.52978

Start using FIPS 140-2 and other Ubuntu security products  

Both Ubuntu FIPS-certified and Ubuntu FIPS-compliant modules are offered under a comprehensive Ubuntu Advantage for Infrastructure package, starting at $75 per VM per year. Check out the full list of Ubuntu security certifications and hardening standards.

Ubuntu cloud

Ubuntu offers all the training, software infrastructure, tools, services and support you need for your public and private clouds.

Newsletter signup

Get the latest Ubuntu news and updates in your inbox.

By submitting this form, I confirm that I have read and agree to Canonical's Privacy Policy.

Related posts

Ubuntu 22.04 FIPS 140-3 modules available for preview

Canonical has been working with our testing lab partner, atsec information security, to prepare the cryptographic modules in Ubuntu 22.04 LTS (Jammy...

Zenbleed vulnerability fix for Ubuntu

On 24 July 2023, security researchers from Google’s Information Security Engineering team disclosed a hardware vulnerability affecting AMD’s Zen 2 family of...

Empowering Australian government innovation: a secure path to open source excellence

The Australian Federal Government is not alone in dealing with challenges like natural disasters, global pandemics and economic uncertainty. Like many...