Will Forensic Tools run in an environment where FIPS is enabled?
Yes. Forensic Tools will run in an environment where FIPS is enabled. Please note that PostgreSQL (if you will be using it) must be set to use SHA-256 for password encryption. This is enabled by default starting in our PostgreSQL 14 release (with Forensic Tools 7.6).
.NET uses the AES algorithm, which is not part of the Windows Platform FIPS validated cryptographic algorithms. Microsoft removed this setting from its security baseline settings in 2014 due in part to its impact on software leveraging the .NET Framework. You can read more about their reasoning here:
Servers that are set to enforce the FIPS algorithm can prevent services from starting and communication to fail with this error being reported:
System.InvalidOperationException: This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.
at ADG.Database.DAL.DALConnection.Decrypt(String __Data)
at ADG.Database.DAL.DALCommand.ExecuteNonQueryWithDecrypt(String format, String encrypted)
at ADG.Database.Definition.UDBInstallUninstall.PrepareDatabase(IDALConnection conn, UDBParams udbParams, Boolean reinstallADMSSQL, CaseDBRecoveryMode recoveryMode)
at ADG.Database.Definition.UDBInstallUninstall.CreateDatabase(UDBParams udbParams, String adminUser, String adminPassword, Boolean reinstallADMSSQL, CaseDBRecoveryMode recoveryMode, Boolean fixSequences)
at ADG.Database.Definition.UDBInstallUninstall.InstallUnifiedDB(UDBParams udbParams, CredentialContext context, IProgress`1 progress, Boolean createAlias)
at DatabaseConfigurationTool.DatabaseForm.CreateDatabaseThread(Object o)
The issue can be resolved with the following steps:
- On each server in the environment, open the Registry Editor (regedit.exe).
- Navigate to Changed this registry key to 0: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\fipsalgorithmpolicy\Enabled.
- Change the value of the key from 1 to 0.
- Reboot the server.
NOTE: Please be aware that this registry change is subject to being re-enabled by Group Policy. The Group Policy setting responsible for this setting is called "System cryptography: Use FIPS compliant algorithms for encryption, hashing and signing" and can be found by expanding the Group Policy console tree to Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\.