[feature] Cryptography & Security Libraries

[tkykenmt]

Overview

• Version: v3.0.0
• Category: feature
• Repositories: opensearch
• PRs: 2

Pull Requests

PR	Title	Category	Repository
#17393	Use BC libraries to parse PEM files, increase key length, allow general use of known cryptographic binary extensions	feature	opensearch
#17507	Migrate BC libs to their FIPS counterparts	feature	opensearch

Tasks

• Investigate PRs
• Create release report: docs/releases/v3.0.0/cryptography--security-libraries.md
• Update feature report: docs/features/cryptography--security-libraries.md

[tkykenmt]

Investigation Complete

Reports Created

• Release report: docs/releases/v3.0.0/features/opensearch/cryptography-security-libraries.md
• Feature report: docs/features/opensearch/cryptography-security-libraries.md (created)

Summary

OpenSearch 3.0.0 migrates from standard Bouncy Castle (BC) libraries to their FIPS-certified counterparts (BC-FIPS), enabling a path toward FIPS 140-2/140-3 compliance. This includes a complete refactoring of PemUtils to use BC libraries for PEM file parsing.

Key Changes in v3.0.0

• BC to BC-FIPS Migration: All Bouncy Castle libraries replaced with FIPS-certified versions:
  • bc-fips 2.0.0 (core provider)
  • bcpkix-fips 2.0.7 (PKIX/CMS support)
  • bctls-fips 2.0.19 (TLS/JSSE provider)
  • bcutil-fips 2.0.3 (utilities)
  • bcpg-fips 2.0.10 (OpenPGP for plugin verification)
• PemUtils Refactoring: Complete rewrite using BC's PEMParser for handling various key formats
• New java.security Configuration: Security provider configuration for BC-FIPS
• Enhanced Key Support: PKCS#1, PKCS#8 (encrypted/unencrypted), EC, DSA formats
• Increased Security Standards: Higher key length requirements, improved Kerberos algorithms

Resources Used

• PR: #17393 - Use BC libraries to parse PEM files
• PR: #17507 - Migrate BC libs to their FIPS counterparts
• Issue: security#3420 - RFC for FIPS 140-2 support
• Blog: Finding a replacement for JSM in OpenSearch 3.0