Install a FIPS-ready CockroachDB Runtime

On this page

Overview of FIPS-ready CockroachDB

Federal Information Processing Standards (FIPS) 140-3 is a U.S. government standard that specifies security requirements for cryptographic modules. FIPS 140-3 provides measurable security guidelines for protecting sensitive but unclassified information. The standard is applicable to all federal agencies that use cryptographic-based security systems to protect sensitive information in computer and telecommunication systems. U.S. and Canadian governments, as well as organizations working with them, may be subject to FIPS 140-3 requirements.

The Cryptographic Module Validation Program (CMVP) validates cryptographic modules to FIPS 140-3 and other cryptography-based standards. When a cryptographic module or library has a FIPS 140-3 certificate, it has been tested and formally validated under the CMVP as meeting the requirements for FIPS 140-3.

FIPS-ready CockroachDB binaries and Docker images are available for CockroachDB v23.1.0 and later. FIPS-ready CockroachDB runtimes run on Intel 64-bit Linux systems.

Starting with v26.1, FIPS-ready CockroachDB binaries are built using Go 1.25's native FIPS 140-3 support. The cryptographic operations are performed by Go's built-in cryptographic modules, which are independent of the host operating system's libraries. This represents a significant architectural change from previous versions (v25.4 and earlier), which used Red Hat's golang-fips toolchain with OpenSSL.

For details about cryptographic algorithms and key lengths used by CockroachDB, refer to Details About Cryptographic Algorithms.

FIPS-ready features

When you use a FIPS-ready CockroachDB runtime, Cockroach Labs has verified that cryptographic operations in the following contexts meet the requirements of FIPS 140-3:

• Encryption At Rest
• Encrypted Backups
• Change Data Capture to Kafka over TLS
• Certificate-based Node-to-Node and Client-to-Node Authentication
• SASL SCRAM-SHA-256 Password Authentication
• SQL Cryptographic Built-in Functions

This page shows how to install and configure a FIPS-ready CockroachDB self-hosted runtime using Go's native FIPS 140-3 support.

Performance considerations

When comparing performance of the same workload in a FIPS-ready CockroachDB runtime to a standard CockroachDB runtime, some performance difference may be observed. The amount of performance impact depends upon the workload, cluster configuration, query load, and other factors.

Upgrading to a FIPS-ready CockroachDB runtime

Upgrading an existing CockroachDB cluster's binaries in-place to be FIPS-ready is not supported.

Operating System Requirements

FIPS-ready CockroachDB v26.1 uses Go's native cryptographic module, which is independent of the host operating system's libraries. The FIPS-ready binary can run on any Intel 64-bit Linux system.

The FIPS-ready CockroachDB Docker images are based on Red Hat's Universal Base Image 10. To use the FIPS-ready CockroachDB Docker image, skip directly to that section of this page.

Extend Red Hat's Universal Base Image 10 Docker image

If you do not want to use the FIPS-ready CockroachDB Docker image directly, you can create a custom Docker image based on Red Hat's Universal Base Image 10:

• You can model your Dockerfile on the one that Cockroach Labs uses to produce the FIPS-ready Docker image for CockroachDB.
• The FIPS-ready binary includes the FIPS 140-3 Go Cryptographic Module and does not require additional system libraries to be installed.

Download FIPS-ready runtimes

To download FIPS-ready CockroachDB runtimes, use the following links.

Testing releases

Install the FIPS-ready CockroachDB runtime

After you download a FIPS-ready CockroachDB binary, install it in the same way as the standard binary. Refer to Install CockroachDB on Linux.

Verify that CockroachDB is FIPS-ready

To verify that the CockroachDB binary is FIPS-ready, use the cockroach version command and check for the FIPS enabled field:

cockroach version | grep -i fips

FIPS enabled: true

This indicates that CockroachDB was built with Go's native FIPS 140-3 support.

Use the FIPS-ready CockroachDB Docker image

The FIPS-ready CockroachDB Docker image is based on Red Hat Universal Base Image 10 and includes the FIPS-ready CockroachDB binary.

1. Go to Download FIPS-ready Runtimes and copy the name of a FIPS-ready Docker image tag. The image tag format is cockroachdb/cockroach:v26.1.0-fips (replace with the specific version).

2. Pull the Docker image locally, create a new container that uses it, run the container, and attach to it. The following example gives the running container the name cockroachdb-fips-container. Replace {image_tag} with the name of the Docker image tag you copied.

   docker run {image_tag} --name="cockroachdb-fips-container" -i
   

3. In the running container, verify that CockroachDB is FIPS-ready.

4. To stop the container, use CTRL-C. To detach from the container but keep it running in the background, use the sequence CTRL+P+CTRL+Q.

Password Requirements in FIPS Mode

FIPS 140-3 has stricter requirements for password length compared to FIPS 140-2. When running a FIPS-ready CockroachDB binary, the minimum password length is 14 characters. This aligns with NIST's recommendation that HMAC keys should have a length of at least 112 bits, which translates to 14 ASCII characters.

Details about cryptographic algorithms

This section provides more information about the cryptographic algorithms and key lengths used by FIPS-ready CockroachDB.

Authentication

Inter-node and node identity

Algorithm: TLS 1.3 (RFC 8446).

Refer to Using Digital Certificates with CockroachDB.

Client identity

Password authentication

Algorithm: bcrypt or scram-sha-256.

Refer to SASL/SCRAM-SHA-256 Secure Password-based Authentication.

Client certificates

Algorithm: TLS 1.3 (RFC 8446).

Refer to Using Digital Certificates with CockroachDB.

GSSAPI / Kerberos

Not supported for FIPS-ready deployments.

SASL / SCRAM password authentication

Algorithm: scram-sha-256.

Refer to SASL/SCRAM-SHA-256 Secure Password-based Authentication.

JSON Web Tokens (JWTs)

Algorithms: Specified by the server.jwt_authentication.jwks cluster setting.

Refer to Cluster Single Sign-on (SSO) using a JSON web token (JWT).

DB Console Authentication via OIDC

Algorithm: Specified by the identity provider (IdP) as part of the OIDC handshake process.

Refer to Single Sign-on (SSO) for DB Console.

HTTP API access via login tokens

Algorithm: sha256 (RFC 6234).

Encryption

In flight

Algorithm: TLS 1.3 (RFC 8446).

Key sizes: Depends upon the cipher suite in use:

• TLS 1.2:

  • tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
  • tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
  • tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
  • tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
  • If the COCKROACH_TLS_ENABLE_OLD_CIPHER_SUITES environment variable is set:
  • tls.TLS_RSA_WITH_AES_128_GCM_SHA256
  • tls.TLS_RSA_WITH_AES_256_GCM_SHA384

• TLS 1.3:

  • TLS_AES_128_GCM_SHA256
  • TLS_AES_256_GCM_SHA384

At rest

Customer-managed backups

AWS

Default encryption provided by the AWS Encryption SDK.

GCP

Default encryption provided by Google Cloud.

Data Encryption at Rest (EAR)

Algorithm: Advanced Encryption Standard (AES) encryption, in counter (CTR) mode.

Key sizes: The store key is specified by the user, and can be of length 16, 24, or 32 bytes (corresponding to AES-128, AES-192, or AES-256). Data keys are the same length as the store key.

See also

• Install CockroachDB
• Releases