These release notes describe the new features and product enhancements for Verastream SDK for Unisys and Airlines 5.0 SP1 (released in September, 2017) and Unisys and Airlines 5.0 SP1 Update 1 (released in January, 2018):
The Verastream SDK uses the FIPS 140-2 validated BCJFA 1.0.0 package from The Legion of the Bouncy Castle to establish secure sessions using the SSL/TLS protocol. The packages are validated for use with Java versions 1.7 and higher. They require that the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files be installed in the JRE. Their operation also requires that you set up a keystore file for use in authentication.
NOTE:Unisys and Airlines 5.0 SP1 Update 1 has been upgraded to use the bc-fips-1.0.1 and bctls-fips-1.0.3 jar files to address security vulnerability CVE-2017-13098. This will require updating the classpath for applications using secure connections. (Version 5.0 SP1 (without the update) uses the bc-fips-1.0.0 and bctls-fips-1.0.1 jar files.)
The FIPS 140-2 validated RSA BSAFE SSL-J package from RSA is not supported in this release. If you are upgrading the SDK for an application that uses FIPS 140-2 security, you will need to modify your solution as shown in Section 3.0, Upgrading from Previous Releases.
Before you start, make sure your system has the required prerequisites.
Make sure that the Microsoft .NET framework and the Oracle JRE are installed as required. The Verastream SDK setup tool does not install the .NET framework or the JRE. You will need to install them separately.
For COM and .NET applications, make sure that .NET Framework 4.0 or higher is installed.
For all applications, make sure that Oracle SE 1.7.0_51 JRE or higher is installed. For COM and .NET applications, use the 32-bit JRE. (COM and .NET applications developed with the Verastream SDK do not support the 64-bit JRE.)
Verify that your machine meets the system requirements as shown in System Requirements (http://docs.attachmate.com/verastream/vsdk/5.0.1/documentation/content/#gs_reqs.html).
You can install the Verastream SDK on a workstation, or you can create an administrative installation. An administrative installation image is a network share that includes an image of the downloaded product distribution or CD. This image can later be used to install the SDK on multiple workstations, either through end-user installations or by using deployment tools.
The use of the Bouncy Castle packages (new in this release) has introduced new requirements for applications. If your application uses secure connections in FIPS140 mode, you will need to modify your solution to meet the following requirements:
If FIPS140 mode is used for any connection, it must be used for all secure connections. The mixing of FIPS140 and non-FIPS140 sessions is no longer supported.
The only acceptable keystore format in FIPS140 mode is the BCFKS format. Any other format results in connection errors. Existing keystores must be converted to (or recreated in) BCFKS format.
Applications which do not use FIPS140 mode should not require any changes (though SSL 3.0 is no longer supported).
Follow the instructions in Setting up the SDK for Secure Connections (http://docs.attachmate.com/verastream/vsdk/5.0.1/documentation/content/#ssltls.html) to set up your application to connect with security.
Customers with a current maintenance plan are eligible to download Verastream SDK for Unisys and Airlines from the Attachmate Download Library at http://download.attachmate.com/Upgrades/.
For more information on using the Download Library, see Technical Note 0200 (https://support2.microfocus.com/techdocs/0200.html).
NOTE:The product download is a full product package that can be used for new installations or to upgrade existing installations.
You can review the following references before you install the product:
The installation directory also includes these references, along with samples and other content to help you use the SDK.
For information about legal notices, trademarks, disclaimers, warranties, export and other use restrictions, U.S. Government rights, patent policy, and FIPS compliance, see https://www.microfocus.com/about/legal/.
Copyright © 2018 Attachmate Corporation, a Micro Focus company. All rights reserved.
The only warranties for this product and any associated updates or services are those that may be described in express warranty statements accompanying the product or in an applicable license agreement you have entered into. Nothing in this document should be construed as creating any warranty for a product, updates, or services. The information contained in this document is subject to change without notice and is provided “AS IS” without any express or implied warranties or conditions. Micro Focus shall not be liable for any technical or other errors or omissions in this document. Please see the product’s applicable end user license agreement for details regarding the license terms and conditions, warranties, and limitations of liability.Any links to third-party websites take you outside Micro Focus websites, and Micro Focus has no control over and is not responsible for information on third party sites.