CODEWITHSUNDEEP
goencryptioncryptographyfipsboringssl
Ben S
Ben S

Reputation: 115

Go dev.boringcrypto branch - x/crypto library FIPS 140-2 compliance

The dev.boringcrypto branch of Go replaces the built-in crypto modules with a FIPS-verified version:

We have been working inside Google on a fork of Go that uses BoringCrypto (the core of BoringSSL) for various crypto primitives, in furtherance of some work related to FIPS 140-2. We have heard that some external users of Go would be interested in this code as well, so this branch holds the patches to make Go use BoringCrypto.

Poking around through the source code, I can see the modifications to the low-level crypto code. However, the Go packages that I've been using all use the x/crypto library, which I couldn't see any references to in the branch on first look. I would like some clarification around the suitability of this library in relation to FIPS 140-2 - if I compiled a project that uses x/crypto with a boringcrypto Go build, would the library become FIPS-compliant as well?

If this isn't the case - why not? If Go has a maintained FIPS-verified branch, why wouldn't a fundamental crypto library also have the same modifications?

Upvotes: 4

Views: 2234

Answers (1)

Woodstock
Woodstock

Reputation: 22956

Once there is an active CMVP (Cryptographic module validation programme), for the library you are using, then you can be assured of the FIPS 140-2 validation.

Remember, there are both "compliance" and "accreditation" concepts spoken about in relation to FIPS.

"Compliance" is where the underlying cipher is on the list of approved cryptographic primitives, i.e. AES256-CBC.

"Accreditation/Validation" is where the underlying library has been specifically audited by a NIST approved lab.

It's the latter you must rely upon for FIPS 140-2 production use (FedRAMP etc).

Looks like CMVP #3753 is what you need.

Any modification to the parameters underlying the certificate invalidates the accreditation.

Upvotes: 2

Related Questions