The Security Policy Document: Microsoft Windows FIPS 140 Validation (version 1.4 dated May 7, 2020) mentions in section 2.2:
2.2 FIPS 140-2 Approved Algorithms
Cryptographic Primitives Library implements the following FIPS-140-2 Approved algorithms:
- NIST SP 800-38D AES-128, AES- 192, and AES-256 GCM decryption and GMAC
Note the explicit use of decryption and not encryption. Furthermore, section 2.3 says the following (where the meaning or purpose of the word Mode is unclear to me in this context ):
2.3 Non-Approved Algorithms
Mode Cryptographic Primitives Library implements the following non-approved algorithms:
- NIST SP 800-38D AES-128, AES-192, and AES-256 GCM encryption
Apparently a FIPS-approved version of AES-GCM encryption is not available. Trying to confirm this from NIST's Cryptographic Algorithm Validation Program (CAVP) certificates directly is not easy though. For example, taking #C211 as the starting point, there are several references to AES-GCM but no distinction between encryption and decryption.
This lack of availability of encryption comes across as a severe restriction. For example it seems not possible to implement an encrypted two-way session with AES-GCM when operating in FIPS Mode. Is this really the case? If yes, what could be the rationale for such limitation?
Update: after a lot more searching, I found confirmation in actual NIST CMVP certificate pages that older versions of Windows did indeed only have AES-GCM decryption validated and not encryption. My conclusion is that the security policy document associated with the newer validations is an evolution of an older policy document and that it was never properly updated to reflect the validation of the encryption side.
I am fairly convinced that this is a documentation error but I think only Microsoft can confirm that.
