FIPS 140-3

The Federal Information Processing Standards (FIPS) 140-2 and its successor 140-3 define security requirements for the cryptographic modules used to protect sensitive information. Government agencies and similar organizations often require systems to run in a FIPS-enabled environment, where only FIPS-approved cryptographic algorithms are permitted.

For its OpenSSL-based cryptography, Yellowbrick uses OpenSSL, which includes OpenSSL's FIPS provider — the self-contained component that implements the FIPS-approved algorithms. The FIPS provider is versioned and validated separately from the base OpenSSL library (libcrypto/libssl) that supplies the rest of the API: Yellowbrick's FIPS provider is built from OpenSSL 3.1.2 — the FIPS 140-3 validated version (validation certificate #4985) — while the surrounding OpenSSL library may be a different 3.x release. This describes the cryptographic library that Yellowbrick uses; Yellowbrick itself is not FIPS validated.

Running in a FIPS-enabled environment also requires that only FIPS-approved algorithms are used. The most common consideration is how local database user passwords are hashed. By default, Yellowbrick hashes local passwords with MD5, which is not a FIPS-approved algorithm: a client running on a FIPS-enabled operating system cannot authenticate a local database account whose password is stored with MD5, and the connection fails. In these environments, users must store local passwords using SCRAM-SHA-256, which uses only FIPS-approved primitives. MD5 remains the default so that existing deployments are unaffected; SCRAM-SHA-256 is opt-in. See Password Encryption.