Thank you for a good question and bringing out this requirement.

We had not been aware of the FIPS version of Bouncy Castle so far, so we will have to take a closer look at them. The first impression is that we should be able to support them with rather small modifications.

We won’t be able to remove support for the non-FIPS version, but since we have a flexible CryptoProvider model, we can add support for the FIPS as an alternative that you can choose from. At best it would work automatically depending on which libraries are available on the class path. Similar that we are supporting Spongy Castle for Android at the moment.

How soon would you need this?

We are working on 4.3.0 release at the moment. When that is done, we can try to integrate this one in. I will let you know when we get something to try out. Hopefully in the coming weeks.

We now have a beta build that should be able to work with BC FIPS, within some limitations. Sending beta link via email.

Also mentioning here some general about the limitations, just in case someone else needs this until we have a proper documentation.

You must set the java system property “org.bouncycastle.rsa.allow_multi_use” to “true” in order for it to work. This can be done by example by starting the jvm with the flag “-Dorg.bouncycastle.rsa.allow_multi_use=true”. There is no way around this that I would be aware of. Not sure how relevant that is to you. This is because OPC UA uses the same key for signing and encrypting, which by default is not allowed by the BC FIPS.

Additionally you most likely need at least Java 8 in order for it to work, per https://www.bouncycastle.org/fips_faq.html it is certified for 1.7 and 1.8. We were not able to get it to run within Java 6. However Java 11 from AdoptOpenJDK did also work. Note that we made minimalistic testing at this point, but a sign&encrypt connection works between sampleconsoleclient and sampleconsoleserver.

Additionally, the bc-fips jar appears to be a so called “Multi-Release” jar. By that mechanism it has a “module-info.class” for Java 9+. IF run within a system that would look at META-INF for data, it might not work if the system is not aware of multi-release jars (and in practice thus Java 9+ aware). Normal java launching commands should be fine, but e.g. some older versions of GlassFish are not (https://stackoverflow.com/questions/50139267/exception-while-glassfish-server-started/50139449).