@Rocky Does Starrocks offers any kind of solution when we need to be FIPS compliant?

As of the current version, StarRocks does not officially support a "FIPS Mode" or a native FIPS-validated configuration. While StarRocks provides standard security features like SSL/TLS authentication and Transparent Data Encryption (TDE), there are several known technical hurdles that prevent it from being strictly FIPS 140-2/3 compliant out of the box: * Hardcoded Algorithms: Some internal processes (like object naming or partition hashing) in the Java-based Frontend (FE) use non-FIPS compliant algorithms like MD5 or SHA-1. In a strict FIPS-enforced environment, these can trigger

NoSuchAlgorithmException

. * Library Linking: The Backend (BE) nodes often link against specific versions of OpenSSL (like 1.1.x) that may not be the FIPS-validated versions provided by your host operating system. * Java Cryptography Extension (JCE): There is currently no "first-class" way to inject FIPS-validated providers (like BouncyCastle FIPS) into the FE via simple configuration without manual and brittle classpath modifications. Current Status and Recommendations * Community Tracking: There are active feature requests (e.g., GitHub Issue #71243) focusing on "Algorithm Agility" to allow StarRocks to run on FIPS-hardened OS kernels without crashing. * Manual Hardening: Some users attempt to run StarRocks on a FIPS-enabled OS (like RHEL in FIPS mode), but this is not officially tested or supported and often requires complex workarounds. * Commercial Support: If FIPS compliance is a hard requirement for your organization, it is recommended to contact CelerData (the commercial entity behind StarRocks). They often handle enterprise-grade compliance and may have a roadmap or specific builds for regulated industries. For the most up-to-date information, you should monitor the StarRocks GitHub repository or ask in the community Slack. References • administration/management/FE_configuration.md • administration/user_privs/ssl_authentication.md • administration/management/BE_configuration.md • sql-reference/sql-functions/crytographic-functions/aes_encrypt.md