Administer > System Security > FIPS mode > Limitations of FIPS mode

Limitations of FIPS mode

The following limitations exist in the support of FIPS mode for Service Manager (SM).

Service Manager initialization might be slow in Linux/Unix environments

This issue may occur when fipsmode:2 is specified in the SM Server's sm.ini file. It is caused by a lack of entropy (randomness) available on the system used for random number generation and can commonly occur on systems that are not receiving much direct user input, such as virtual machines.

As a workaround, you can direct the JVM to use /dev/urandom with the following directive:

  • Add the following line to the Server's sm.ini file:

    JVMOption0:-Djava.security.egd=file:/dev/./urandom
  • Alternatively, you can add the following line to the jre/lib/security/java.security file:

    securerandom.source=file:/dev/./urandom

For additional information, see the following important third-party information:

http://bugs.java.com/view_bug.do?bug_id=6521844

http://www.2uo.de/myths-about-urandom/

Minimum required versions for WebSphere Application Server and IBM JDK

If you are using WebSphere Application Server and IBM JDK for SM, be sure to use WebSphere Application Server version 8.5 (8.5.5.2 or a higher) and IBM JDK 7.1 (7.1.3.10 or higher). If you use an earlier version of WebSphere or IBM JRE, Service Manager runs in partial FIPS mode because random generation is not compliant with the latest FIPS standards.