FipsComplianceChecker

Checks FIPS 140-2/3 mode availability at runtime.

On devices with Conscrypt/BoringSSL compiled in FIPS mode (e.g., government-provisioned devices), the JCE security provider reports FIPS compliance. This checker detects that state.

SDK crypto operations that are FIPS-compliant when running on a FIPS-mode provider:

• AES-256-GCM (queue payload encryption, field-level encryption)

• ECDSA P-256 (config signature verification, audit entry signing)

• SHA-256 (hash chain, content hashing)

• HMAC-SHA256 (request signing)

Operations NOT covered by FIPS scope:

• Android Keystore wrapping (hardware-backed, not software FIPS)

• TLS negotiation (delegated to platform, typically BoringSSL)