We have an app that makes use of Non FIPS compliant AES256 System.Cryptography calls. My question is, can Bitlocker be FIPS140 compliant on a PC, but not need the FIPS algorithm set for .NET calls?
For the U.S. Government (VA), are told we need the policy enabled for FIPS, Policy Editor --> Security Settings --> Local Policies --> Security Options --> System cryptography: Use FIPS compliant algorithm ... enabled. (We are also told this coincides with: Set the Enabled value to 1 in HKLM\System\CurrentControlSet\Control\Lsa\FIPSAlgorithmPolicy, which is what the PC image folks are doing.)
The good news is that this changes the Bitlocker config so that Recovery passwords are not created or backed up.
The bad news is that .NET calls to Non-FIPS compliant APIs result in a hard exception: "This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms. Stack: at System.Security.Cryptography.AesManaged..ctor()" It might not be so tricky to refactor, but this actually is vendor API code, so we have to arrange with them to re-code.
I have reviewed this a few times.