FIPS 140-2 compliant enforcement on Mule 4.6/4.9 LTS since 18th August, 2025

Please see the reference if you need more information about FIPS:

NIST/CMVP References:

• FIPS 140-2 Publication: The primary document outlining the security requirements for cryptographic modules.
  • https://csrc.nist.gov/publications/detail/fips/140/2/final
• FIPS 140-2 Annex A - Approved Security Functions: A list of the approved security functions for FIPS 140-2.
  • https://csrc.nist.gov/files/pubs/fips/140-2/upd2/final/docs/fips1402annexa.pdf
• FIPS 140-3 Publication: The latest version of the standard, which supersedes FIPS 140-2.
  • https://csrc.nist.gov/pubs/fips/140-3/final
• FIPS 140-3 Development and Transition: Information on the transition from FIPS 140-2 to FIPS 140-3.
  • https://csrc.nist.gov/projects/fips-140-3-transition-effort
• CMVP validated module search.
  • https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules/search
• CMVP validation for BC-FJA (Bouncy Castle FIPS Java API)
  • https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4943

Vendor References (Bouncy Castle):

• Bouncy Castle FIPS Home:
  • https://www.bouncycastle.org/documentation/documentation-java/
• Bouncy Castle FIPS FAQ: A list of frequently asked questions about the Bouncy Castle FIPS API.
  • https://www.bouncycastle.org/about/bouncy-castle-fips-faq/#java-fips-questions
• Bouncy Castle Java FIPS Documentation
  • BC-FJA (Bouncy Castle FIPS Java API) User Guide
  • Java (D)TLS API and JSSE Provider User Guide
  • BC-FIPS Porting guide
  • Non-Proprietary FIPS 140-3 Cryptographic Module Security Policy

Note: MuleSoft do not own above links.