Documentation - V-261896

Title

PostgreSQL must use NIST FIPS 140-2/140-3 validated cryptographic modules for cryptographic operations.

Description

<VulnDiscussion>Use of weak or not validated cryptographic algorithms undermines the purposes of using encryption and digital signatures to protect data. Weak algorithms can be easily broken and not validated cryptographic modules may not implement algorithms correctly. Unapproved cryptographic modules or algorithms should not be relied on for authentication, confidentiality, or integrity. Weak cryptography could allow an attacker to gain access to and modify data stored in the database as well ...

Fix Text (Documentation Requirement)

If crypto.fips_enabled = 0 for Red Hat Linux, configure the operating system to implement DOD-approved encryption. To enable strict FIPS compliance, the fips=1 kernel option must be added to the kernel command line during system installation so key generation is done with FIPS-approved algorithms and continuous monitoring tests in place. Enable FIPS mode with the following command: # sudo fips-mode-setup --enable Modify the kernel command line of the current kernel in the "grub.cfg" file by adding the following option to the GRUB_CMDLINE_LINUX key in the "/etc/default/grub" file and then rebuilding the "grub.cfg" file: fips=1 Changes to "/etc/default/grub" require rebuilding the "grub.cfg" file. On BIOS-based machines, use the following command: # sudo grub2-mkconfig -o /boot/grub2...