I am working on a security-related project and have to make sure it is FIPS 140-2 compliant.
According to my understanding, FIPS compliance is compliance at hardware as well as software level. Currently there are 2 Samsung Android devices which are FIPS compliant, i.e. they have compliance at hardware and software level. I have a few questions.
If I want to make my Android app FIPS compliant, if the only crypto module used in my project is compliant, is it enough?
The crypto module provided by the Android SDK is the BouncyCastle library and it is not FIPS compliant.
I am using the FIPS-compliant OpenSSL library in my project as per https://stackoverflow.com/questions/11091905/android-build-openssl-fips-2-0. I have built my project library using the OpenSSL library ie
libssl.a
andlibcrypto.a
configured using FIPS mode.According to the the FIPS OpenSSL module for Android documentation, the module has been tested on different Android devices of armv7 architecture. Will Android hardware not being FIPS compliant matter here ?
AES algorithm is under FIPS compliance. Does this mean that if I use the AES algorithm in Java code instead of using the FIPS-compliant OpenSSL library, it isn't FIPS compliant?
If AES is under FIPS compliance, what does it have to do with a Java or C# implementation of AES. Do they both have to pass through the CMVP?