Record Class FipsProfile

java.lang.Object
java.lang.Record
com.svenruppert.jsentinel.credential.standards.FipsProfile
Record Components:
strictMode - if true, only FIPS-acceptable algorithms are permitted at the operator's decision boundary
allowsArgon2 - Argon2id (BouncyCastle) — never FIPS-validated as of FIPS 140-3
allowsBcrypt - bcrypt (BouncyCastle) — never FIPS-validated
allowsScrypt - scrypt (BouncyCastle) — never FIPS-validated
allowsHibpSha1Prefix - the HIBP k-anonymity protocol computes a SHA-1 digest of the candidate; SHA-1 is deprecated in FIPS 180-4 §6 for hashing — set false in strict deployments
public record FipsProfile(boolean strictMode, boolean allowsArgon2, boolean allowsBcrypt, boolean allowsScrypt, boolean allowsHibpSha1Prefix) extends Record
Operator-declared FIPS operating profile.

This is an advisory configuration record. The framework does not auto-detect FIPS mode, does not switch providers, and does not change algorithm selection based on this value. Its purpose is to give operators one explicit place to declare the intent of the deployment, suitable for inclusion in audit logs and static configuration checks.

See docs/security/credentials/standards/fips-profile.md for the position statement and the operator checklist that this record is paired with.

  • Constructor Details

    • FipsProfile

      public FipsProfile(boolean strictMode, boolean allowsArgon2, boolean allowsBcrypt, boolean allowsScrypt, boolean allowsHibpSha1Prefix)
      Creates an instance of a FipsProfile record class.
      Parameters:
      strictMode - the value for the strictMode record component
      allowsArgon2 - the value for the allowsArgon2 record component
      allowsBcrypt - the value for the allowsBcrypt record component
      allowsScrypt - the value for the allowsScrypt record component
      allowsHibpSha1Prefix - the value for the allowsHibpSha1Prefix record component

  • Method Details

    • permissive

      public static FipsProfile permissive()
      Permissive default: no FIPS claims. All algorithm modules are allowed; the deployment makes no statement about FIPS mode at all.

    • strict

      public static FipsProfile strict()
      Strict default: only FIPS-acceptable algorithms are allowed. Argon2, bcrypt, scrypt and HIBP SHA-1 prefix are forbidden. The JDK distribution and java.security configuration still have to be operator-verified — this record does not verify them.

    • toString

      public final String toString()
      Returns a string representation of this record class. The representation contains the name of the class, followed by the name and value of each of the record components.
      Specified by:
      toString in class Record
      Returns:
      a string representation of this object

    • hashCode

      public final int hashCode()
      Returns a hash code value for this object. The value is derived from the hash code of each of the record components.
      Specified by:
      hashCode in class Record
      Returns:
      a hash code value for this object

    • equals

      public final boolean equals(Object o)
      Indicates whether some other object is "equal to" this one. The objects are equal if the other object is of the same class and if all the record components are equal. All components in this record class are compared with the compare method from their corresponding wrapper classes.
      Specified by:
      equals in class Record
      Parameters:
      o - the object with which to compare
      Returns:
      true if this object is the same as the o argument; false otherwise.

    • strictMode

      public boolean strictMode()
      Returns the value of the strictMode record component.
      Returns:
      the value of the strictMode record component

    • allowsArgon2

      public boolean allowsArgon2()
      Returns the value of the allowsArgon2 record component.
      Returns:
      the value of the allowsArgon2 record component

    • allowsBcrypt

      public boolean allowsBcrypt()
      Returns the value of the allowsBcrypt record component.
      Returns:
      the value of the allowsBcrypt record component

    • allowsScrypt

      public boolean allowsScrypt()
      Returns the value of the allowsScrypt record component.
      Returns:
      the value of the allowsScrypt record component

    • allowsHibpSha1Prefix

      public boolean allowsHibpSha1Prefix()
      Returns the value of the allowsHibpSha1Prefix record component.
      Returns:
      the value of the allowsHibpSha1Prefix record component