mirror of
https://github.com/slackhq/nebula.git
synced 2026-09-30 11:26:38 +02:00
Wade Simmons
9c5d701648
Add support for the "fips140" mode of Go: - https://go.dev/doc/security/fips140 - https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5247 You can build with `make fips140`, see the README changes for more info. Some differences from the boringcrypto builds: - We switch to using `go:linkname crypto/tls.aeadAESGCMTLS13`, which gives us the fips implementation for both `boringcrypto` and `fips140` modes. This means we also no longer need `-checklinkname=0` - Go native `fips140` doesn't need CGO_ENABLED=1 - We decide if we should use the fips140 GCM at runtime, if `fips140.Enabled()` is true. If you use the `make release-fips140`, we build with build tag `fips140enforce` which ensures the binary is running with fips140 enabled and that only P256 / AES-GCM is being used. If you don't want this enforce mode, you can build without the build tag.
26 lines
419 B
Go
26 lines
419 B
Go
//go:build !boringcrypto
|
|
|
|
package noiseutil
|
|
|
|
import (
|
|
"crypto/fips140"
|
|
|
|
"github.com/flynn/noise"
|
|
)
|
|
|
|
// EncryptLockNeeded indicates if calls to Encrypt need a lock
|
|
var EncryptLockNeeded = fips140.Enabled()
|
|
|
|
var CipherAESGCM noise.CipherFunc = initAESGCM()
|
|
|
|
func initAESGCM() noise.CipherFunc {
|
|
if fips140.Enabled() {
|
|
return CipherAESGCMFIPS140
|
|
} else {
|
|
return noise.CipherAESGCM
|
|
}
|
|
|
|
}
|
|
|
|
var boringEnabled = false
|