personal_interest_mirrors/nebula
1
0
Fork 0
mirror of https://github.com/slackhq/nebula.git synced 2026-09-30 09:36:37 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity
803 Commits 90 Branches 29 Tags
9c5d7016489cb194db1a8bf27edc2145ac71ab32
Commit Graph
3 Commits
Author SHA1 Message Date
Wade Simmons 9c5d701648 Support native Golang "fips140" mode (#1696) 
Add support for the "fips140" mode of Go:

- https://go.dev/doc/security/fips140
- https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5247

You can build with `make fips140`, see the README changes for more info.

Some differences from the boringcrypto builds:

- We switch to using `go:linkname crypto/tls.aeadAESGCMTLS13`, which gives us the fips implementation for both `boringcrypto` and `fips140` modes. This means we also no longer need `-checklinkname=0`
- Go native `fips140` doesn't need CGO_ENABLED=1
- We decide if we should use the fips140 GCM at runtime, if `fips140.Enabled()` is true. If you use the `make release-fips140`, we build with build tag `fips140enforce` which ensures the binary is running with fips140 enabled and that only P256 / AES-GCM is being used. If you don't want this enforce mode, you can build without the build tag.
 2026-08-21 19:33:40 -04:00
zhetaicheleba e5f60fa54f chore: fix some typos in comments (#1582) 
Signed-off-by: zhetaicheleba <taicheleba@outlook.com>
 2026-01-20 11:03:31 -05:00
Wade Simmons e0553822b0 Use NewGCMTLS (when using experiment boringcrypto) (#803) 
* Use NewGCMTLS (when using experiment boringcrypto)

This change only affects builds built using `GOEXPERIMENT=boringcrypto`.
When built with this experiment, we use the NewGCMTLS() method exposed by
goboring, which validates that the nonce is strictly monotonically increasing.
This is the TLS 1.2 specification for nonce generation (which also matches the
method used by the Noise Protocol)

- https://github.com/golang/go/blob/go1.19/src/crypto/tls/cipher_suites.go#L520-L522
- https://github.com/golang/go/blob/go1.19/src/crypto/internal/boring/aes.go#L235-L237
- https://github.com/golang/go/blob/go1.19/src/crypto/internal/boring/aes.go#L250
- https://github.com/google/boringssl/blob/ae223d6138807a13006342edfeef32e813246b39/include/openssl/aead.h#L379-L381
- https://github.com/google/boringssl/blob/ae223d6138807a13006342edfeef32e813246b39/crypto/fipsmodule/cipher/e_aes.c#L1082-L1093

* need to lock around EncryptDanger in SendVia

* fix link to test vector
 2023-04-05 11:08:23 -04:00