Configuring compliance for NIST SP 800-131A in DWA

You can configure IBM® Engineering Requirements Management DOORS® - Web Access (DWA) to communicate over secure sockets in compliance with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-131A standard. That standard specifies the algorithms to use to strengthen security, and the minimum encryption strengths that are required for the algorithms.

1. Open the Apache Tomcat startup script file in an editor and add parameters for the SSL protocol, the SP 800-131A compliance level, and the cipher suites. At the com.ibm.jsse2.usefipsprovider entry that you added for FIPS 140-2, add JAVA_OPTS entries for these parameters:

   Parameter	Value
   https.protocols	Set to TLSv1.2. The protocol must be compatible with the protocols that are enabled on the remote server.
   com.ibm.jsse2.sp800-131	Set to strict.
   https.cipherSuites	Enter a supported cipher suite. This parameter restricts the ciphers that are used by outgoing requests for remote services. These cipher suites must be compatible with the cipher suites that are set for the remote server.

   • On Windows systems, the server.start.bat script file is in the DWA installation directory; for example, <DOORSWebAccess_install_dir>\version. This example includes the required values for the SSL protocol and compliance level parameters, and an example of supported cipher suites:

     set JAVA_OPTS=%JAVA_OPTS% -Dhttps.protocols=TLSv1.2
     set JAVA_OPTS=%JAVA_OPTS% -Dcom.ibm.jsse2.usefipsprovider=true 
     set JAVA_OPTS=%JAVA_OPTS% -Dcom.ibm.jsse2.sp800-131=strict
     set JAVA_OPTS=%JAVA_OPTS% -Dhttps.cipherSuites="SSL_RSA_WITH_AES_128_CBC_SHA, SSL_DHE_RSA_WITH_AES_128_CBC_SHA, 
     SSL_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA"
     
     cd %CATALINA_HOME%\bin
     call ".\startup.bat"

   • On Linux® systems, the server.start.sh script file is in the DWA installation directory. This example includes the required values for the SSL protocol and compliance level parameters, and an example of supported cipher suites:

     JAVA_OPTS="$JAVA_OPTS -Dhttps.protocols=TLSv1.2"
     JAVA_OPTS="$JAVA_OPTS -Dcom.ibm.jsse2.usefipsprovider=true" 
     JAVA_OPTS="$JAVA_OPTS -Dcom.ibm.jsse2.sp800-131=strict"
     JAVA_OPTS="$JAVA_OPTS -Dhttps.cipherSuites=SSL_RSA_WITH_AES_128_CBC_SHA,SSL_DHE_RSA_WITH_AES_128_CBC_SHA,SSL_DHE_DSS_WITH_AES_128_CBC_SHA,SSL_RSA_WITH_3DES_EDE_CBC_SHA,SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA"
     
     export JAVA_OPTS

   For strict compliance, key strength and signature algorithms are also verified. Strict compliance allows only TLS 1.2 protocol. You must ensure that the certificates, keys, and secure random number generator, if specified, all comply with SP 800-131A.

2. Save and close the file.
3. Open the Apache Tomcat server.xml file in an editor.
   That file is in the DWA installation in the server/conf directory; for example, C<DOORSWebAccess_install_dir>\version\server\conf
4. In the HTTPS connector section, set the sslProtocol and sslEnabledProtocols values to the minimum TLS version, which is based on the value that is determined by the com.ibm.jsse2.sp800-131 system property value; for example:

   sslProtocol="TLSv1.2"
   sslEnabledProtocols="TLSv1.2"
     

   For more information about the HTTPS connector section, see Configuring DWA to use SSL or TLS.
5. Set the cipher suites to further restrict what the server accepts. The value for this entry must match the value that is used in the https.cipherSuites parameter in the server startup script, as described in step 1; for example:

   ciphers="SSL_RSA_WITH_AES_128_CBC_SHA, SSL_DHE_RSA_WITH_AES_128_CBC_SHA, SSL_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA,
       SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA"

   Ensure that Secure Sockets Layer (SSL) is configured to use only an approved cipher suite for SP 800-131A. For a list of cipher suites, see "IBM JSSE2 Cipher Suites" in Related information.