I don't get exactly what FIPS 140-2 expects when your method receives secret keys via arguments. For example, in a lot of FIP-compliant libraries such as OpenSSL, we have a method like this:
int EVP_EncryptInit_ex(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *type,
ENGINE *impl, const unsigned char *key, const unsigned char *iv)
which starts symmetric cryptography operation. This method takes plain key as an argument. How does getting plain keys in the method interface satisfy the requirements of FIPS 140-2? Because I thought for FIPS 140-2, we need to have a secure method for importing secret/private keys inside the FIPS module.
Any idea?