Search code examples
securitycassandrafipsnosql

Is Cassandra FIPS 140-2 certified

Searched the web to find if Apache Cassandra is FIPS 140-2 compliant but did not find any reference. Any pointer or details in this regard would help.

Solution

  • Is Cassandra FIPS 140-2 certified?

    According to NIST's Validated FIPS 140-1 and FIPS 140-2 Cryptographic Modules, there are no modules named "Apache" or "Cassandra" that are FIPS validated.

    There's also a Modules in Progress, which lists binaries that are in various stages of testing. Neither "Apache" nor "Cassandra" are listed there, either.

    You should check the underlying security library, like NSS or OpenSSL. It could be the module Cassandra uses FIPS validated cryptography from another library, like NSS or OpenSSL. The manual should discuss it, even if its only one paragraph.