3

I'm currently evaluating encrypting data in-transit for an Oracle SE2 12.1 Amazon RDS instance in accordance with HIPAA requirements.

Specifically, I'm considering the use of Oracle Native Network Encryption [1,2] (the alternative option being Oracle SSL [3,4]). I'm trying to piece together the documentation from Oracle, Amazon, HIPAA, NIST, etc. to determine the appropriate HIPAA-compliant approach.

From Amazon's HIPAA Whitepaper [5]:

Connections to Amazon RDS for Oracle containing PHI must use transport encryption and evaluate the configuration for consistency with the Guidance. This is accomplished using Oracle Native Network Encryption and enabled in Amazon RDS for Oracle option groups.

From the HIPAA Guidance [6]:

Valid encryption processes for data in motion are those which comply, as appropriate, with NIST Special Publications 800-52, Guidelines for the Selection and Use of Transport Layer Security (TLS) Implementations; 800-77, Guide to IPsec VPNs; or 800-113, Guide to SSL VPNs, or others which are Federal Information Processing Standards (FIPS) 140-2 validated.

Based on this doc, it seems that the Oracle network encryption must be FIPS 140-2 validated. However, I'm not certain whether the Oracle network encryption meets this criteria; I haven't quite been able to confirm this from the Oracle/FIPS/other docs.

In particular, I've found the following Oracle 12.1 documentation related to FIPS 140-2:

The FIPS 140-2 cryptographic libraries are designed to protect data at rest and in transit over the network.

Oracle Database uses these cryptographic libraries for Secure Sockets Layer (SSL), Transparent Data Encryption (TDE), and DBMS_CRYPTO PL/SQL package.

To configure Transparent Data Encryption and the DBMS_CRYPTO PL/SQL package program units to run in FIPS mode, set the DBFIPS_140 initialization parameter to TRUE.

You can configure the SSLFIPS_140 parameter for Secure Sockets Layer.

However, given the documentation, I'm not sure that these FIPS parameters apply to the Oracle native network encryption, nor whether they are necessary.

  • Is Oracle native network encryption [1,2] HIPAA/FIPS compliant?
  • If so, is any configuration required or is it compliant by default?
  • Are there certain encryption algorithms that are/are not compliant?

[1] http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.Oracle.Options.NetworkEncryption.html
[2] http://docs.oracle.com/cd/E11882_01/network.112/e40393/asoconfg.htm#ASOAG9581
[3] http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.Oracle.Options.SSL.html
[4] http://docs.oracle.com/cd/E11882_01/network.112/e40393/asossl.htm#ASOAG9689
[5] https://d0.awsstatic.com/whitepapers/compliance/AWS_HIPAA_Compliance_Whitepaper.pdf
[6] https://www.hhs.gov/hipaa/for-professionals/breach-notification/guidance/index.html

1

SSLFIPS_140 is used for SSL-based encryption. That is not related to native network encryption.

Is Oracle native network encryption [1,2] HIPAA/FIPS compliant?

If so, is any configuration required or is it compliant by default?

https://docs.oracle.com/database/121/DBSEG/asoappe.htm#DBSEG1061

For native encryption, this behavior of cryptographic operations landing in RSA/Micro Edition Suite (MES) and being accelerated is similar to the above, except that it is determined by the FIPS_140 setting in sqlnet.ora (instead of the SSL_FIPS140 setting in fips.ora).

This parameter is available since version 12.1.

Are there certain encryption algorithms that are/are not compliant?

https://docs.oracle.com/database/121/DBSEG/asoappe.htm#DBSEG9828

Only the following cipher suites are approved for FIPS validation:

  • SSL_DH_anon_WITH_3DES_EDE_CBC_SHA
  • SSL_RSA_WITH_AES_256_CBC_SHA
  • SSL_RSA_WITH_AES_128_CBC_SHA
  • SSL_RSA_WITH_AES_256_GCM_SHA384
  • SSL_RSA_WITH_3DES_EDE_CBC_SHA

Could not find a list specifically for native encryption, but you can set the algorithms based on the above. After setting the above parameter, if you choose an algorithm that is not compliant, you can not connect to the database and will receive the below error:

ORA-12630: Native service operation not supported
  • Thank you. I had overlooked the FIPS_140 param in the 12.1 doc since it is buried in a section related to SSL (and it is the only mention of native encryption in the entire doc). This param was better documented for 11.2, but that doc indicated compliance with FIPS 140-1, not 140-2. Now the outstanding issue is that Amazon RDS does not seem to support the configuration of this property... – shelley Mar 11 '17 at 4:01
0

From the Oracle docs

9.1.1 Advanced Encryption Standard Oracle Advanced Security supports the Federal Information Processing Standard (FIPS) encryption algorithm, Advanced Encryption Standard (AES). AES can be used by all U.S. government organizations and businesses to protect sensitive data over a network. This encryption algorithm defines three standard key lengths, which are 128-bit, 192-bit, and 256-bit. All versions operate in outer Cipher Block Chaining (CBC) mode.

Oracle has 140-*

This appendix describes how to configure Oracle Database for the Federal Information Processing Standard (FIPS), for the current standard, 140-2, and for 140-1. To verify the current status of the certification, you can find information at the Computer Security Resource Center (CSRC) Web site address from the National Institute of Standards and Technology:

According to your docs 140-2 is HIPAA

So just set SSLFIPS_140=TRUE

It must be set to TRUE on both the client and the server for FIPS mode operation.

Special note..

To comply with FIPS 140-2 Level 2 requirements, the security policy must include procedures to prevent unauthorized users from reading, modifying or executing Oracle Cryptographic Libraries processes and the memory they are using in the operating system.

"Security Policy" ie, chmod a-w those libraries.

  • Thank you. I had seen both of those documents; however, the first from the network encryption doc indicates "FIPS" but does not specify "FIPS 140-2". Regarding the SSLFIPS_140 parameter, that is for the SSL Adapter, not the Oracle Native Network Encryption, right? – shelley Mar 10 '17 at 1:07
  • I don't think "Oracle Native Network Encryption" is a thing. That sounds like marketing wank. That said, if it is a thing and it's not just a reference to SSL I would avoid it. HIPAA accepts 140-2. 140-2 is claimed to be supported with that option which clearly uses SSL. – Evan Carroll Mar 10 '17 at 1:14
  • I think "Native Network Encryption" is the term used by Amazon RDS, but the Oracle docs refer to it as "Oracle Advanced Security Encryption" and describe it as "native Oracle Net Services data encryption". It is not SSL. See the links in the original question – shelley Mar 10 '17 at 3:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.