It appears to me that only the specification of the encryption algo has to be FIPS 140-2 approved. There is a list with approved functions and techniques.
NIST SP 800-53 SC-13 is pretty clear that it must not just be an approved function, but also FIPS validated cryptography, which is done under FIPS 140-2 and the validated products are listed here: http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-...
I've heard compliance people joke often enough that it's perfectly possible to get a piece of rock FIPS certified. (not that the standards are bad, necessarily, just the thrust of the policies are such that rocks would pass by sheer virtue of not enabling bad actions)
Comments
It appears to me that only the specification of the encryption algo has to be FIPS 140-2 approved. There is a list with approved functions and techniques.
FIPS PUB 140-2 Annexes: Annex A: Approved Security Functions (Draft 04-08-2016)
Annex B: Approved Protection Profiles (Draft 11-18-2015)
Annex C: Approved Random Number Generators (Draft 01-04-2016)
Annex D: Approved Key Establishment Techniques (Draft 10-08-2014)
NIST SP 800-53 SC-13 is pretty clear that it must not just be an approved function, but also FIPS validated cryptography, which is done under FIPS 140-2 and the validated products are listed here: http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-...
I've heard compliance people joke often enough that it's perfectly possible to get a piece of rock FIPS certified. (not that the standards are bad, necessarily, just the thrust of the policies are such that rocks would pass by sheer virtue of not enabling bad actions)