To adhere to the Library of Congress (LoC) standards regarding the strong encryption of data in transit, it is essential that all exposed HTTP endpoints in our Java module utilizing the Vert.x toolkit are secured using TLS and FIPS-140-2 compliant cryptographic modules.

Requirements:

1. TLS Support:

   • The edge module must support enabling and disabling SSL/TLS for served HTTP endpoints.

   • Include detailed logging for SSL/TLS activations or deactivations to aid in troubleshooting and auditing.

2. FIPS 140-2 Compliance:

   • Implement functionality to enable or disable the usage of FIPS 140-2 compliant cryptographic modules. Use Bouncy Castle's Java FIPS library as the cryptographic provider (refer to Bouncy Castle FIPS Java).

   • Ensure that the module can be configured to run in either a strict FIPS mode or in a non-FIPS mode for development and testing purposes.

3. Keystore Configuration:

   • The module should provide configuration parameters to specify:

     • The location of the keystore file (keystorePath).

     • The keystore password (keystorePassword).

     • The specific key alias to use within the keystore (keyAlias).

   • Ensure all sensitive configuration inputs (like passwords) are handled securely, preferably using environment variables or secure vault solutions.

4. Documentation and Samples:

   • Provide detailed documentation on how to configure and use these security features.

   • Include example configurations and code snippets in the module's README or an accompanying documentation page.

5. Testing:

   • Implement comprehensive unit and integration tests to verify TLS functionality and the use of FIPS-compliant cryptographic modules.

   • Tests should cover both positive scenarios (correct configuration) and negative scenarios (incorrect configurations, missing keystore, etc.).

6. Performance Considerations:

   • Evaluate the impact of enabling FIPS-compliant cryptography on the performance of HTTP endpoint communications.

   • Document any observed performance overheads and provide tuning guidelines if necessary.

Acceptance Criteria:

• All exposed HTTP endpoints must be capable of operating with SSL/TLS encryption.

• The module must be configurable to use FIPS 140-2 compliant cryptographic modules and fall back to non-FIPS mode as required.

• Configuration changes and the operational state (enabled/disabled) of these features must be logged.

• The solution must pass all specified tests and should not introduce significant performance degradation.

• Documentation must be complete and user-friendly, enabling easy setup and configuration by end-users.