Which JCE providers are FIPS 140-2 compliant?

Question

What Java Cryptography Extension (JCE) providers are FIPS 140-2 compliant? More specifically, does the Sun/Oracle provider qualify?

Answer 1

According to this information on this page:

1. IBM and RSA have FIPS 140-2 validated JCE providers.
2. BouncyCastle have FIPS 140-2 validated JCE providers for Java 7 & 8. (See The Legion of the Bouncy Castle - FIPS Resources Page. Donations are encouraged!)
3. Sun's JCE providers are not on the list of FIPS 140-2 validated modules.

However, Oracle do have a validated module called "Oracle Cryptographic Libraries for SSL". The description does not say this is a JCE provider ... but it might be.

Also, Oracle don't appear to have any "modules in progress" for FIPS 140-2 validation.

Answer 2

Actually the Sun PKCS#11 Provider does look like it is FIPS 140-2 compliant. It is based on Network Security Services. I'm pretty sure that is what certificates 1278, 1279 and 1280 are on that NIST link that @stephen-c posted. The Oracle docs are a little vague regarding compliance but this is the best I have found so far.

Answer 3

According to this page, java 6 can be made FIPS 140 compliant via either NSS or SunJSSE.