Security Requirements for Cryptographic Modules (FIPS 140-2), specifies the security requirements that will be satisfied by a cryptographic module utilized within a security system protecting sensitive information. Further details are available in this document published by the National Institute for Standards and Technology.
The server supports all FIPS-140 compliant cryptographic algorithms, as well as other algorithms required by older or non FIPS-140 compliant endpoints.
To help assist those with FIPS 140-2 obligations, we have created this page to outline which portion of SFTPPlus functionality applies to FIPS 140-2.
While SFTPPlus is not FIPS 140-2 certified and does not have a certification number, it can be configured to run with a set of ciphers and cryptographic algorithms that are complaint to the FIPS 140-2 standard.
The fips configuration value in the ssh_cipher_list configuration option can be used to allow using only FIPS 140-2 compliant ciphers and algorithms for the SSH based services.
By using the fips keyword in this configuration, a pre-defined set of FIPS 140-2 approved ciphers is available. When fips ciphers are enabled, any other configured cipher in the list is ignored.
Further details are available at the ssh_cipher_list in the SSH (SFTP and SCP) Service page.
We believe that we have followed the requirements laid out in the FIPS 140-2 computer security standard for Security Level 1 and that SFTPPlus meets those requirements.
According to NIST, Security Level 1 covers basic security requirements specified for a cryptographic module. No specific physical security mechanisms are also required in a Security Level 1 cryptographic module beyond the basic requirement for production-grade components.
Supporting the FIPS 140-2 certification is on our roadmap, but the product has not yet been certified.