I've recently been tasked with a research project to write a "secure messaging application" using "government approved protocols" (the government being the USA). I'm taking this to mean asymmetric encryption and government approved cryptographic algorithms, AKA FIPS 140(-1?), and hashing (FIPS 180-x).
Some Android devices such as the Galaxy S4 and HTC One are advertised as being FIPS certified.
Does application level code get to take advantage of the certified implementation on these devices? E.G., if I use the standard Android/Java API's to open an HTTPS connection, or generate a SHA256 hash, would those calls be done with a FIPS certified implementation?
- that would mean they've replaced the default android JCE provider, correct?
- is there any way to determine that a FIPS certified JCE is available?
- in order to make a FIPS certifiable app, at the minimum one would need to use JNI to call out to a FIPS certified OpenSSL implementation, or an alternative pure java JCE provider, correct? (outside of creating a custom implementation)
- assuming using a FIPS certified OpenSSL implementation, this would mean that any secure networking calls (HTTPS for example), would have to be done either in native code (C) invoking the OpenSSL implementation, or use JNI to invoke the OpenSSL libraries? That would seem to be very cumbersome.
- Are there any FIPS certified pure-java JCE providers that will work with Android? Open Source or reasonably low cost preferred. I've looked at the list, but it's hard to tell what's something a developer can get ahold of and use in an app, vs an OEM. The two that jump out are RSA's Jsafe, and IBM's JCE. RSA's is the only one that appears to be certified on Android, but best I've been able to find out it's upwards of $200,000, which would be too pricy for a small research project. But assuming it's out there and works, I could perhaps proceed using something like Spongy Castle using the same algorithms, and hopefully just changing out the provider would work (e.g., if somebody wanted to foot the bill.)