FIPS - which cryptograhic module is used for crypto operations?

[jwojcie]

Hi, I'm a bit baffled by a FIPS compliance statement in README.md, it says that library is "FIPS compliant: linux-aarch_64, linux-x86_64"
Questions:

• I understand that aws-crt-java is not FIPS certified and all crypto operations are passed to some cryptographic module, true?
• I understand that (at least) for TLS aws-crt-java doesn't use JVM security providers but in case of linux it is using https://github.com/aws/s2n-tls. Does s2n-tls performs crypto operations or does it fall back to some certified library? I mean I can't find certificate for s2n-tls here:
  https://csrc.nist.gov/Projects/cryptographic-module-validation-program/validated-modules/search

Basically what I need to know is how to find out the crypto module used by aws-crt-java when CRT.isFIPS() == true on my linux env, so I can find the certificate number of that crypto module for obligatory reporting.

[TingDaoK]

We use aws-lc as our crypto module.

[jwojcie]

Thank you @TingDaoK , can you point which one? CMVP gives me three results
https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules/search?SearchMode=Basic&ModuleName=aws-lc&CertificateStatus=Active&ValidationYear=0
Which I guess is inline with information here:
https://github.com/aws/aws-lc/blob/c48572a808ba3edc969ef3797ce9d4b0b120394e/crypto/fipsmodule/FIPS.md

AWS-LC-FIPS v1.0: certificate #4631 - security policy

AWS-LC-FIPS v2.0 (dynamic library): certificate #4759 - security policy

AWS-LC-FIPS v2.0 (static library): certificate #4816 - security policy

[graebm]

AWS-LC-FIPS v2.0 (static library): certificate #4816

It's this one

I asked the AWS-LC team to be extra sure. AWS-LC is compiled statically for aws-crt-java.

Great question! I added this information to our README.md (see PR: #848)