Package com.documentum.fc.common

Class DfcSecurityProviderManager

java.lang.Object
com.documentum.fc.common.DfcSecurityProviderManager
public final class DfcSecurityProviderManager extends Object
Central manager for cryptographic security provider selection in DFC.

FIPS mode is automatically enabled at startup when the environment variable FIPS_ENABLED=true is set. When FIPS mode is active, DFC will use the Bouncy Castle FIPS provider (BCFIPS) and attempts to register it from the classpath before any cryptographic operation. If the BCFIPS provider cannot be found or instantiated, an IllegalStateException is thrown — there is no silent fallback when FIPS mode is explicitly requested. When the variable is absent or set to any value other than "true" (case-insensitive), DFC uses the JDK default (Sun) security providers.

This class provides factory methods for all JCE/JCA objects that automatically route through the appropriate provider.

Since:
25.4

  • Field Details

    • PROVIDER_BCFIPS

      public static final String PROVIDER_BCFIPS
      Bouncy Castle FIPS provider name.
      See Also:

    • KEYSTORE_TYPE_PKCS12

      public static final String KEYSTORE_TYPE_PKCS12
      FIPS-approved keystore type (PKCS12 — uses AES + SHA, FIPS 140-3 compliant).
      See Also:

    • KEYSTORE_TYPE_JKS

      public static final String KEYSTORE_TYPE_JKS
      Legacy keystore type (JKS — proprietary Sun format using MD5; not FIPS-compliant). Retained as a constant so callers can reference it explicitly for migration / fallback.
      See Also:

    • FIPS_ENABLED_ENV

      public static final String FIPS_ENABLED_ENV
      Environment variable name to enable FIPS mode.
      See Also:

  • Method Details

    • getInstance

      public static DfcSecurityProviderManager getInstance()
      Returns the singleton instance.

    • isFipsMode

      public boolean isFipsMode()
      Returns whether FIPS mode is currently enabled.

    • getActiveProviderName

      public String getActiveProviderName()
      Returns the name of the active cryptographic provider. Returns null if no provider has been explicitly registered.

    • getProviderName

      public String getProviderName()
      Returns the active provider name for Bouncy Castle operations.
      Returns:
      the provider name to use, or null to use JDK defaults

    • getCipher

      public Cipher getCipher(String transformation) throws NoSuchAlgorithmException, NoSuchPaddingException
      Creates a Cipher instance, routing through the appropriate provider when FIPS mode is enabled.
      Parameters:
      transformation - the cipher transformation (e.g. "AES/CBC/PKCS5Padding")
      Returns:
      a Cipher instance
      Throws:
      NoSuchAlgorithmException - if the transformation is not available
      NoSuchPaddingException - if the padding is not available

    • getMessageDigest

      public MessageDigest getMessageDigest(String algorithm) throws NoSuchAlgorithmException
      Creates a MessageDigest instance, routing through the appropriate provider when FIPS mode is enabled.
      Parameters:
      algorithm - the digest algorithm (e.g. "SHA-256")
      Returns:
      a MessageDigest instance
      Throws:
      NoSuchAlgorithmException - if the algorithm is not available

    • getSecureRandom

      public SecureRandom getSecureRandom(String algorithm) throws NoSuchAlgorithmException
      Creates a SecureRandom instance, routing through the appropriate provider when FIPS mode is enabled.
      Parameters:
      algorithm - the PRNG algorithm (e.g. "SHA1PRNG"), or null for default
      Returns:
      a SecureRandom instance
      Throws:
      NoSuchAlgorithmException - if the algorithm is not available

    • getSecureRandom

      public SecureRandom getSecureRandom()
      Creates a default SecureRandom instance appropriate for the current mode.
      Returns:
      a SecureRandom instance

    • getSecretKeyFactory

      public SecretKeyFactory getSecretKeyFactory(String algorithm) throws NoSuchAlgorithmException
      Creates a SecretKeyFactory instance, routing through the appropriate provider when FIPS mode is enabled.
      Parameters:
      algorithm - the key factory algorithm
      Returns:
      a SecretKeyFactory instance
      Throws:
      NoSuchAlgorithmException - if the algorithm is not available

    • getKeyGenerator

      public KeyGenerator getKeyGenerator(String algorithm) throws NoSuchAlgorithmException
      Creates a KeyGenerator instance, routing through the appropriate provider when FIPS mode is enabled.
      Parameters:
      algorithm - the key generation algorithm
      Returns:
      a KeyGenerator instance
      Throws:
      NoSuchAlgorithmException - if the algorithm is not available

    • getKeyPairGenerator

      public KeyPairGenerator getKeyPairGenerator(String algorithm) throws NoSuchAlgorithmException
      Creates a KeyPairGenerator instance, routing through the appropriate provider when FIPS mode is enabled.
      Parameters:
      algorithm - the key pair generation algorithm (e.g. "RSA")
      Returns:
      a KeyPairGenerator instance
      Throws:
      NoSuchAlgorithmException - if the algorithm is not available

    • getKeyStore

      public KeyStore getKeyStore() throws KeyStoreException
      Creates a PKCS12 KeyStore instance.

      PKCS12 is the FIPS 140-3 approved keystore container format, using AES for key encryption and SHA for integrity protection via the JDK's own defaults. It is used in both FIPS and non-FIPS mode.

      In FIPS mode, BCFIPS is registered at priority 1 (see registerFipsProviderDirect()) and supplies its own PKCS12 engine, which falls back to legacy 3DES/SHA-1 instead of the JDK's modern AES/SHA-256 defaults. This method therefore explicitly requests the JDK's PROVIDER_SUNJSSE provider so its compliant PKCS12 implementation is used instead. In non-FIPS mode BCFIPS is never registered (see registerProvider()), so the default provider-less lookup is used unchanged.

      Returns:
      a PKCS12 KeyStore instance
      Throws:
      KeyStoreException - if PKCS12 is unavailable (indicates a JVM configuration problem)

    • getKeyStore

      public KeyStore getKeyStore(String type) throws KeyStoreException
      Creates a KeyStore instance of the given type, routing through the FIPS provider when FIPS mode is active.
      Parameters:
      type - the keystore type (e.g. KEYSTORE_TYPE_PKCS12, KEYSTORE_TYPE_JKS)
      Returns:
      a KeyStore instance
      Throws:
      KeyStoreException - if the keystore type is not available