Oracle | FIPS

Oracle FIPS Flagging Version 140-3

General Information

Library Note

Morgan's Library Page Header

The best Oracle News for FY2026

Oracle Database 26ai will be available on generic Linux platforms in January and soon on AIX and Windows

Purpose FIPS 140-3 is the current U.S. and Canadian government standard for validating cryptographic modules. FIPS ensures that sensitive data is securely encrypted and and aligns with international ISO standards (ISO/IEC 19790).

FIPS sets rigorous requirements for security levels (1-4) and testing by the Cryptographic Module Validation Program (CMVP), making it the benchmark for both government and private sectors.

FIPS specifies encryption algorithms and mandates strict testing of firmware, hardware, and software to protect against vulnerabilities.

Key Aspects
Cryptographic Module: The core component that performs encryption, decryption, and key management.

Security Levels
Defines four levels, from basic (Level 1) to high-security physical tamper resistance (Level 4).

Testing
Requires independent lab testing against specific Derived Test Requirements (DTRs).

Scope
Covers hardware, software, and firmware, protecting sensitive data in federal, defense, financial, and cloud systems.

Proper configuration of FIPS requires compliance with US DOD DISA STIGs x and y.

Initialization Parameter

SQL> show parameter fips

      

      NAME                 TYPE       VALUE

      -------------------- ---------- --------------------

      DBFIPS_140           boolean    FALSE

      

      ALTER SYSTEM SET dbfips_140=TRUE SID='*' SCOPE=SPFILE;

      

      System altered.

      

      SHUTDOWN IMMEDIATE;

      

      STARTUP;

      

      SQL> show parameter fips

      

      NAME                 TYPE       VALUE

      -------------------- ---------- --------------------

      DBFIPS_140           boolean    TRUE

FIPS.ORA File

FIPS Flagging

The Federal Information Processing Standard for SQL (FIPS 127-2) requires a way to identify SQL statements that use vendor-supplied extensions ALTER SESSION SET FLAGGER=<ENTRY | FULL | INTERMEDIATE | OFF>;

conn uwclass/uwclass@pdbdev

      

      CREATE OR REPLACE FUNCTION test(x IN VARCHAR2) RETURN VARCHAR2

      AUTHID DEFINER IS

      BEGIN

        RETURN x;

      END;

      /

      Function created.

      

      ALTER SESSION SET flagger=FULL;

      

      Session altered.

      

      CREATE OR REPLACE FUNCTION test(x IN VARCHAR2) RETURN VARCHAR2

      AUTHID DEFINER IS

      BEGIN

        RETURN x;

      END;

      /

      CREATE OR REPLACE FUNCTION test(x VARCHAR2) RETURN VARCHAR2

      *

      ERROR at line 1:

      ORA-00097: use of Oracle SQL feature not in SQL92 Full Level

      

      ALTER SESSION SET flagger=OFF;

      

      Session altered.

      

      CREATE OR REPLACE FUNCTION test(x VARCHAR2) RETURN VARCHAR2

      AUTHID DEFINER IS

      BEGIN

        RETURN x;

      END;

      /

      Function created.

Header (new 21c)