Domino r6.5.5 is not FIPS 140-2 certified

HCL Domino Domino Forum
1

(and all earlier releases, afaik)

Dear IBM/Lotus,

I do hope that you clearly understand that Domino lacking this certification at this point - and, from all appearances, it not being a high priority - is easily perceived as an abandonment of market segment. So far as I know, the DOD requires FIPS 140-2 certification on applications which perform secure, encrypted data transfer; it is expected to be more broadly adopted by other institutions (eg: Financial, Medical, etc) in the not too distant future.

Thanks guys, you’ve had my 15 yrs of involvement with the product. I reasonably expected more than a ‘sorry Charley’ in response.

Have a nice day, Regards,

Gary Groeller

ps: if anyone knows an approved method, “work around”, for this limitation, I’d appreciate hearing about it!

2

Subject: ND6 is ancient, and somebody apparently missed Lotusphere this year…

I should probably start by pointing out that ND6 is ancient, and 6.x are maintenance releases. If we added a feature that large to an MR without prior warning customers and business partners would be very cranky with us.

That said, the security roadmap presented at Lotusphere this year includes support for a FIPS 140-2 certified cryptographic library, and also during Lotusphere FIPS 140-2 support for encrypted email was publically announced as targeted for 8.0.1, thus warning our customers and business partners. :slight_smile: