added commentary of FIPS IG A.5 and GCM compliance.

zjsunzone · Oct 5, 2019 · 9948457 · 9948457
1 parent b4bf563
commit 9948457
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/tls/src/main/java/org/bouncycastle/jsse/provider/FipsUtils.java b/tls/src/main/java/org/bouncycastle/jsse/provider/FipsUtils.java
@@ -10,7 +10,9 @@
 abstract class FipsUtils
 {
     private static final boolean provAllowRSAKeyExchange = PropertyUtils.getBooleanSystemProperty("org.bouncycastle.jsse.fips.allowRSAKeyExchange", true);
-    private static final boolean canSupportGCM = true;
+    // This can only be set to true if the underlying provider is able to assert it is compliant with FIPS IG A.5
+    // and a mechanism has been integrated into this API accordingly to ensure that is the case.
+    private static final boolean canSupportGCM = false;
 
     private static final Set<String> FIPS_SUPPORTED_CIPHERSUITES = createFipsSupportedCipherSuites();
     private static final Set<String> FIPS_SUPPORTED_PROTOCOLS = createFipsSupportedProtocols();