Currently, FogBugz uses algorithms that are not FIPS-compliant (namely, MD5) and will throw exceptions when run on a server that is configured to enforce the use of FIPS-compliant algorithms.
Areas of FogBugz that use MD5
As of FogBugz 8.7.61, these are the areas in FogBugz that make use of the MD5 algorithm.
- FogBugz currently uses Lucene.NET for search. Part of Lucene uses MD5 to compute hashes.
- The search store buffer use MD5 to compute a hash string.
- The search index uses MD5 to compute a database hash
- Fragment Cache - FogBugz uses MD5 as part of our HTML fragment cacher, which also is used as a function memoization tool.
- (On Demand Only) Plugins - FogBugz hashes the hosted plugins using MD5
- Plugins - FogBugz hashes database connection strings using MD5
- (On Demand Only) AB Test - Part of the AB Testing code for FogBugz On Demand uses MD5.
- ActionTokens - MD5 is used when generating action tokens, which are used to help prevent cross site forgery requests.
- Password Encryption - FogBugz uses MD5 to encrypt a user's password (this is salted and then heavily iterated; full implementation details are intentionally withheld).
- NOTE: Using an alternative form of authentication (LDAP or AD) will not use this are of FogBugz code.
- Licensing - FogBugz licensing code uses MD5 to verify licenses.
- Gravatar - FogBugz can use Gravatar for user icons. Gravatar requires using MD5 to hash a user's email address.
- Tests - Several unit tests use MD5.
FIPS-compliance in future versions of FogBugz
While Fog Creek is considering producing a version of FogBugz that uses FIPS-compliant algorithms exclusively, this is not something that is currently scheduled to ship.
If FIPS compliance is a major concern and you intend to use FogBugz, you might consider running FogBugz on Linux, which does not throw blanket exceptions for MD5 algorithm usage. Your organization may require a manual audit, in which case you may wish to use the outline above to understand where MD5 is being used. If using MD5 within password hashing is a concern, consider switching to using LDAP or AD authentication to avoid this issue.
If you are also using Kiln, it may be possible to use a FIPS-compliant version of Kiln on Windows combined with FogBugz running on Linux. We haven't tested this, so we're not sure of everything that would be required in order to get this to work. If FIPS is a major requirement and you are considering this configuration, please contact us.
Note that FogBugz performs best running on Windows using SQL Server as the database.