bc-fips 2.1.1 FIPS-compliance question - HMAC difference?

[mtorba]

I'm trying to find the latest certified version of bc-fips to use. https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4943 suggests that 2.1.1 is the latest certified version, cool. I look into the certification pdf - https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp4943.pdf - and therein I find validation information: that running java -cp bc-fips-2.1.1.jar org.bouncycastle.util.DumpInfo should provide me with verification info, specifically Module SHA2-256 HMAC: d231036b466c2216d352c4c1ee9df602bc6e05514817bdfea2eab8a376566e90

Now, I tried downloading that artifact from two different maven repositories - maven-central-apache and maven-central-repo1. Both produce the same artifact, byte-identical. But when I run the given command using the downloaded artifact I get the following:

java -cp artifacts/maven-central-repo1/bc-fips-2.1.1.jar org.bouncycastle.util.DumpInfo
Version Info: BouncyCastle Security Provider (FIPS edition) v2.1.1
FIPS Ready Status: READY
Module SHA-256 HMAC: 0f861e85a3fdc00707c9d164f8335bc81d81723944575d5ac80b4273c0d930a5

So a completely different HMAC. What gives? The artifact fingerprint (7B121B76A7ED6CE6E60AD51784E913A8E3A748C0) matches the one published on Bouncy Castle site, so it doesn't look like an attack, just a discrepancy. But it makes me worry if using it in my program will pass FIPS certification

[ECD5A]

I found an additional reference: section 2.5 of the BC-FJA 2.1.1 User Guide lists exactly the HMAC you obtained: 0f861e85a3fdc00707c9d164f8335bc81d81723944575d5ac80b4273c0d930a5.

This conflicts with the d231… value in the NIST-hosted Security Policy you linked. So your result matches BC’s own user guide, although that does not resolve the certificate question.

I couldn’t establish from these documents why the values differ. Confirmation from Bouncy Castle is still needed on which artifact corresponds to certificate #4943.