Support native Golang "fips140" mode by wadey · Pull Request #1696 · slackhq/nebula

wadey · 2026-04-27T18:18:49Z

Add support for the "fips140" mode of Go:

You can build with make fips140, see the README changes for more info.

Some differences from the boringcrypto builds:

We switch to using go:linkname crypto/tls.aeadAESGCMTLS13, which gives us the fips implementation for both boringcrypto and fips140 modes. This means we also no longer need -checklinkname=0
Go native fips140 doesn't need CGO_ENABLED=1
We decide if we should use the fips140 GCM at runtime, if fips140.Enabled() is true. If you use the make release-fips140, we build with build tag fips140enforce which ensures the binary is running with fips140 enabled and that only P256 / AES-GCM is being used. If you don't want this enforce mode, you can build without the build tag.

This will replace boring crypto at some point. We should modify our protocol a bit and instead change to NewGCMWithRandomNonce.

This reverts commit 08ee2ab.

Requires go1.26 for fips140.Version()

This reverts commit 1403473.

This reverts commit 65450f9.

nbrownus · 2026-04-29T18:36:54Z

-	cd .github/workflows/smoke/ && NAME="smoke-p256" CURVE="P256" ./build.sh
-	cd .github/workflows/smoke/ && NAME="smoke-p256" ./smoke.sh
+	cd .github/workflows/smoke/ && $(GOENV) ./build.sh
+	cd .github/workflows/smoke/ && $(GOENV)./smoke.sh


Missing a space after $(GOENV)

good catch, fixed

nbrownus · 2026-04-29T18:38:02Z


+type cipherAEADDanger interface {
+	EncryptDanger(out, ad, plaintext []byte, n uint64, nb []byte) ([]byte, error)
+	DecryptDanger(out, ad, plaintext []byte, n uint64, nb []byte) ([]byte, error)


plaintext -> ciphertext

im confused, when you call this function it is still plaintext

err nm lol I see

nbrownus · 2026-04-29T18:43:04Z

 	@$(MAKE) service ${.DEFAULT_GOAL} --no-print-directory
 endif

+fips140:


boringcrypto outputs with a suffix on the folder like: build/linux-amd64-boringcrypto/nebula

fips140 outputs to a colliding path with non fips140: build/linux-amd64/nebula, seems like a good idea to push this into build/linux-amd64-fips140/nebula.

good catch! let me rework this.

added release-fips140 and bin-fips140 for this

nbrownus · 2026-04-29T18:45:23Z

-		out = s.c.Seal(out, nb, plaintext, ad)
-		//l.Debugf("Encryption: outlen: %d, nonce: %d, ad: %s, plainlen %d", len(out), n, ad, len(plaintext))
-		return out, nil
+		switch ce := s.c.(type) {


Would be awesome to swap out the interface and avoid the type check for each packet.

Fixed in latest commit

nbrownus · 2026-04-29T23:53:46Z


+fips140:
+	@echo > $(NULL_FILE)
+	$(eval GOENV += GOFIPS140=v1.0.0)


We will also need to require go 1.26 and include this LDFLAGS: -X runtime.godebugDefault=fips140=only

Otherwise fips is enabled but all non fips crypto just keeps working. Will need to couple this with a change to assert fips140.Enforced() is true.

added the default, but not enforcing and instead just logging the state of it. Considering the check.

Implemented with a build tag fips140enforce

nbrownus · 2026-04-29T23:55:31Z

+// EncryptLockNeeded indicates if calls to Encrypt need a lock
+// This is true for fips140 because the Seal function verifies that the
+// nonce is strictly increasing.
+const EncryptLockNeeded = true


The other part of -X runtime.godebugDefault=fips140=only is that we will want an init check to assert fips140.Enforced() here.

Implemented with a build tag fips140enforce.

This is safer because it doesn't clober other defaults that are set by Go or the environment.

Why not?

JackDoan · 2026-07-17T18:51:40Z

+}
+
+func (c *aeadGCMFIPS140Cipher) Seal(dst, nonce, plaintext, additionalData []byte) []byte {
+	if !c.ready {


can we do this as part of extractFIPSAEAD? It would avoid a branch & technically also avoids an opportunity to race (thought my understanding is this should always be called under a lock bc of how the fips nonce checker works

I think we can as long as nothing in our code encrypts with a "0" nonce. I think this is true. Ill test it

actually, the first WriteMessage that noise does is with nonce 0, so this is a bit tricky to optimize

nbrownus · 2026-07-20T16:49:55Z

 	switch curve {
 	case cert.Curve_CURVE25519:
+		if fips140.Enforced() {
+			panic("pki: use of Curve25519 is not allowed in FIPS 140-only mode")


Thoughts on returning an error instead of throwing a panic?

We throw a panic for the other algorithms when fips140.Enforced is turned on. Let me check.

I'm happy with a panic as long as we can show it's not reachable from UDP

ill change to return an error, that matches what stdlib does in my research

JackDoan · 2026-07-31T17:47:46Z

Do we want to check for and respect /proc/sys/crypto/fips_enabled on Linux?

wadey added 11 commits March 31, 2025 12:08

WIP support new Go fips140 module

4485c47

This will replace boring crypto at some point. We should modify our protocol a bit and instead change to NewGCMWithRandomNonce.

log if fips140 in use

3da3d41

WIP

6da314a

Merge remote-tracking branch 'origin/master' into fips140

31cc3a4

cleanup

f6b206d

WIP

0eb92dc

comments

fd3fa57

cleanup

b418a08

Merge remote-tracking branch 'origin/master' into fips140

6fa1ecd

Merge remote-tracking branch 'origin/master' into fips140

2d5d86f

cleanup

08ee2ab

wadey added this to the v1.11.0 milestone Apr 27, 2026

wadey added 12 commits April 27, 2026 16:22

Revert "cleanup"

243cf4a

This reverts commit 08ee2ab.

fix mismerge

ef8b700

fix smoke tests

e6eeb37

log the fips140 mode and version

fcfbec4

Requires go1.26 for fips140.Version()

requires go1.26

f9532f4

need go1.26

65450f9

cleanup, no GODEBUG needed

ae58085

bump linter to support go1.26

1403473

Revert "bump linter to support go1.26"

bdbd483

This reverts commit 1403473.

Revert "need go1.26"

4ff9e97

This reverts commit 65450f9.

no longer need go1.26 with this fix

d4d747f

better default

b79fdc2

nbrownus reviewed Apr 29, 2026

View reviewed changes

wadey added 4 commits July 8, 2026 10:41

use go:debug to enable fips140=only

6675f5a

This is safer because it doesn't clober other defaults that are set by Go or the environment.

run all smoke tests with -race

4e8733c

Why not?

update README

3c1dd52

cleanup

3264ebf

nbrownus mentioned this pull request Jul 8, 2026

v1.11.0 changelog #1792

Merged

56 tasks

JackDoan reviewed Jul 17, 2026

View reviewed changes

JackDoan previously approved these changes Jul 17, 2026

View reviewed changes

wadey added 2 commits July 20, 2026 09:38

Merge remote-tracking branch 'origin/master' into fips140

048fa3f

cleanup nonce

6be3d22

wadey dismissed JackDoan’s stale review via 6be3d22 July 20, 2026 14:03

JackDoan previously approved these changes Jul 20, 2026

View reviewed changes

nbrownus reviewed Jul 20, 2026

View reviewed changes

return err instead of panic

e16a31f

wadey dismissed JackDoan’s stale review via e16a31f July 23, 2026 14:52

wadey added 2 commits July 23, 2026 10:55

note that boringcrypto is deprecated

8d8cc4f

Merge remote-tracking branch 'origin/master' into fips140

009d42b

nbrownus modified the milestones: v1.11.0, v1.12.0 Jul 23, 2026

wadey added 10 commits July 24, 2026 08:17

fix fips140-all

e832250

update PHONY

0d91e3e

one var for default fips version

fc950cf

cleanup

69e5e8e

self-test the reflect code at init

00b498f

test fips140.Enforced mode

0e1f534

cleanup

738b4fa

complain earlier if in FIPS-140 enforced mode

7c00c74

clean up empty line

bf2f26b

use P256 as the default curve for fips140 mode

a5cb635

JackDoan approved these changes Aug 3, 2026

View reviewed changes

Uh oh!

Conversation

wadey commented Apr 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nbrownus Apr 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wadey Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

JackDoan Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wadey Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

JackDoan commented Jul 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

wadey commented Apr 27, 2026 •

edited

Loading

nbrownus Apr 29, 2026 •

edited

Loading

wadey Jun 1, 2026 •

edited

Loading

JackDoan Jul 17, 2026 •

edited

Loading

wadey Jul 23, 2026 •

edited

Loading