Cryptography and FIPS compliance in Teamcenter server

Teamcenter can be configured to use FIPS (Federal Information Processing Standard) standards by using the FIPS-certified Teamcenter Cryptographic Module (TCM). When using the TCM, Teamcenter uses the FIPS PUB 140-2 standard to perform all cryptographic functions. The TCM provides FIPS-140-2 validated encryption, hashing, digital signatures, and random number generation. All Teamcenter cryptographic functions are handled with the OpenSSL-based TcCrypto library. Teamcenter Cryptographic Module (TCM) The TCM is a software library providing an API for use by applications that require cryptographic security. The TCM is classified by FIPS 140-2 as a software module, multichip standalone module embodiment. The Siemens Digital Industries Software Teamcenter Cryptographic Module FIPS 140-2 security Policy (Certificate #2624) is available at https://csrc.nist.gov. The TCM is a cryptographic engine library that is used only in conjunction with additional software. Aside from the use of the NIST-defined elliptic curves as trusted third party domain parameters, all other FIPS 186‐3 assurances are outside the scope of the TCM, and are the responsibility of the calling process. The TCM software version for this validation is provided in the Siemens Digital Industries Software Teamcenter Cryptographic Module FIPS 140-2 security Policy (Certificate #2624) available at https://csrc.nist.gov. The TCM has the following characteristics: The physical cryptographic boundary is the general purpose computer on which the TCM is installed. The logical cryptographic boundary of the TCM is the TcCryptoFips object module. It is designed to be a shared library. The TcCryptoFips library communicates only with the calling TcCrypto library, which is responsible for invoking the TCM services in FIPS mode. The TCM requires the following initialization sequence. Upon load, the TcCryptoFips library runs the integrity test followed by the self tests. When a calling application requests the module to be in FIPS mode, the TCM invokes FIPS_mode_set() implemented in the TcCryptoFips library. Doing so verifies the user password and reruns the algorithms test, returning a 1 for success or 0 for failure. If FIPS_mode_set() fails, all subsequent cryptographic services in the FIPS module fail. The module can later be initialized in domestic mode and an application can test whether FIPS mode has been successfully enabled. See section 9.5 in Implementation Guidance for FIPS 140-2 and the Cryptographic Module Validation Program available at https://csrc.nist.gov for further information on initialization sequences. Configure Teamcenter to use FIPS standards Configure Teamcenter to use FIPS standards by setting the TCCRYPTO_FORCE_FIPS_MODE environment variable to a value of True. You can also define and set TCCRYPTO_FORCE_FIPS_MODE in the file tc_profilevars.bat (Windows) or tc_profilevars.sh (Linux).