Red Hat Delivers a More Secure Foundation for Modern Applications with First FIPS 140-2 Validation for Red Hat Enterprise Linux 8

RALEIGH, N.C.
—

March 2, 2021
—

Red Hat, Inc., the world’s leading provider of open source solutions, today announced the renewal of the Federal Information Processing Standard 140-2 (FIPS 140-2) security validation for Red Hat Enterprise Linux 8.1. This is the first FIPS certification for the Red Hat Enterprise Linux 8 platform, showing Red Hat’s continued commitment to providing a more secure and production-ready set of open hybrid cloud technologies built on the latest generation of the world’s leading enterprise Linux platform.

This continues Red Hat’s strong commitment to delivering a more secure backbone for sensitive computing deployments across the hybrid cloud and both the public and private sectors.

/>

Driven by the National Institute of Standards and Technology (NIST), FIPS 140-2 is a computer security standard that specifies the requirements for cryptographic modules — including both hardware and software components — used within a security system to protect sensitive information. This validation is needed when agencies determine that specific information systems should use cryptography to protect data; if cryptography is required, then it must be validated.

With this validation for Red Hat Enterprise Linux 8.1, many of Red Hat’s open hybrid cloud offerings also retain the FIPS 140-2 certification as layered products building on Red Hat Enterprise Linux 8.1’s cryptography modules. These include but are not limited to:

• Red Hat Ceph Storage

• Red Hat Gluster Storage

• Red Hat OpenShift

• Red Hat OpenStack Platform

• Red Hat Satellite

• Red Hat Virtualization

Red Hat Enterprise Linux 8.1 includes FIPS 140-2 validation for the following modules:

• OpenSSL Cryptographic Module

• Libgcrypt Cryptographic Module

• NSS Cryptographic Module

• Kernel Crypto API Cryptographic Module

• GnuTLS Cryptographic Module

In Red Hat Enterprise Linux 8, the Libreswan and OpenSSH components were modified to use cryptography exclusively from other validated cryptographic modules, NSS and OpenSSL respectively. This means that these two specific modules no longer require standalone validation as part of the platform or Red Hat’s layered products.

In order to achieve FIPS 140-2 validation, cryptographic modules are subject to testing by NIST-accredited independent Cryptographic and Security Testing Laboratories. The validation for Red Hat Enterprise Linux 8.1 was performed by atsec information security corporation’s Cryptographic and Security Testing Laboratory in Austin, Texas.

In addition to the certification of Red Hat Enterprise Linux 8.1, Red Hat Enterprise Linux 7.7 and Red Hat Enterprise Linux 8.2 are currently on the NIST “Modules In Process” list with the intent to extend FIPS 140-2 validation to these releases.

Supporting Quote

Paul Smith, senior vice president and general manager, Public Sector, North America, Red Hat

“Today’s validation for Red Hat Enterprise Linux 8.1 marks the first FIPS 140-2 certification for the latest generation of the world’s leading enterprise Linux platform. This continues Red Hat’s strong commitment to delivering a more secure backbone for sensitive computing deployments across the hybrid cloud and both the public and private sectors.”