While JDK-7092821 fixed the scalability issue when Cipher.getInstance() is called, there are other excessive synchronization points in the package for legacy algorithms and message digest. It includes:
http://hg.openjdk.java.net/jdk/jdk/file/c83245fe66b3/src/java.base/share/classes/java/security/Provider.java#l1254
http://hg.openjdk.java.net/jdk/jdk/file/c83245fe66b3/src/java.base/share/classes/sun/security/jca/ProviderConfig.java#l164
Mutators still need synchronization to be there, but the reads do not need to be inside the synchronized blocks.