Open with table of contents

Operating in FIPS mode

FIPS (Federal Information Processing Standards) is a set of standards developed by the United States Federal Government for use in computer systems. FIPS 140-2 is the subset of standards which defines approved encryption algorithms used for handling sensitive information.

If your Clearswift Gateway has been pre-configured to operate in FIPS Mode, the cryptographic modules used by the Gateway are compliant with FIPS-140-2.

Consequently, in FIPS mode, you will not be able to do the following:

• Use PGP encryption or decryption
• Set PGP endpoint defaults
• Import or extract PGP keys
• Apply password encryption
• View PGP or Password encryption statistics

Tell me about...

• FIPS-140-2 and the Clearswift Gateway

  Many organizations handle sensitive information on a regular basis. Government departments, financial institutions and other high security industries require a recognized level of security when exchanging information. FIPS-140-2 provides approved standards for message encryption and data handling, and is a key requirement for an increasing number of organizations. In FIPS Mode, the Clearswift Gateway is compliant with this requirement.

  FIPS Mode provides confidence that the Gateway is handling sensitive and unclassified information to the FIPS 140-2 standard required by US Federal Government.

• FIPS and Peered Gateways

  FIPS-enabled Email Gateways can be peered with other FIPS enabled Gateways. However, FIPS compliance can not be extended to Gateway Peers which are not FIPS enabled.

  You can add a FIPS-enabled Email Gateway as a Peer to a CLEARSWIFT SECURE Web Gateway. All subsequent Email Gateway peers must also be FIPS-enabled. Mixed compliance is not permitted for Gateway Peers.

• Backing up and Restoring FIPS Configurations

  You can only restore FIPS configurations to a FIPS enabled Gateway. This ensures FIPS compliance is maintained consistently on your Gateway or across your Gateway Peers.

  You cannot restore a non-FIPS configuration to a FIPS enabled Gateway. You cannot restore a FIPS configuration to a non-FIPS enabled Gateway.

• Gateway services which operate in FIPS Mode

  The following services use FIPS-approved cryptography:

  • SMTP mail services
  • SpamLogic
  • Policy Enforcement
  • Encryption

• FIPS Mode and S/MIME signatures

  If a Gateway is FIPS enabled, weaker S/MIMESecure Multipurpose Internet Mail Extensions (S/MIME) is a specification for secure email messages that uses the X.509 format for digital certificates and uses various encryption algorithms such as 3DES. signatures (for example, signatures from a non-FIPS enabled Gateway) will be identified as 'Unknown'.

• Areas of Non-Compliance

  There are a number of processes that are necessary to the operation of the Gateway which are currently not FIPS compliant. These are described in detail in the FIPS Areas of Non Compliance topic in the Reference section.

How do I...

• Find out whether my Gateway is using FIPS mode?

  From the Gateway Home page, click System > Logs & Alarms.

  Select the System Logs tab.

  If the FIPS Audit log is enabled, the Gateway is operating in FIPS Mode.

  If the FIPS Audit log is disabled, the Gateway is not operating in FIPS Mode.

  Alternatively:

  From the Gateway Home page, click System > Encryption > Encryption/Decryption Defaults.

  If your Gateway is operating in FIPS Mode, the following warning message is displayed:

  While using Email Gateway Clearswift SECURE Exchange Gateway in FIPS mode you will be unable to use PGP or Password as Encryption/Decryption options.

• Enable or Disable FIPS Mode?

  FIPS mode is selected during the installation of Clearswift Gateway. It cannot be enabled (or disabled) without re-installing the Gateway.