I am starting the early stages of researching the possibility of getting FIPS 140-2 certified, but I have run into some confusion. To start, our software is written in Java and does not actually do any of the encryption/decryption, currently that is done by BouncyCastle libraries and the hope is that when BouncyCastle becomes FIPS certified our product can become FIPS certified as well.
The problem I am having is right in the first line, that is what FIPS 140-2 defines as a cryptographic module, it states:
A cryptographic module shall be a set of hardware, software, firmware, or some combination thereof that implements cryptographic functions or processes, including cryptographic algorithms and, optionally, key generation, and is contained within a defined cryptographic boundary.
Since our software is not actually implementing any of these algorithms, we are just using a service provider, does this mean that our product can not be certified? Are we stuck in the FIPS complaint zone? If our software can get FIPS 140-2 certified what would the testing labs actually look at since our software does not do any of the processing?
I have gone through many of the FIPS 140-2 certified projects and it seems that my fears may be true. Most things that are certified are proprietary cryptographic libraries that are used by larger software projects such as the Windows 8 cryptographic kernels and Symantic cryptographic libraries.