Support native Golang "fips140" mode #1696
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,78 @@ | ||
| //go:build fips140v1.0 | ||
| // +build fips140v1.0 | ||
|
|
||
| package noiseutil | ||
|
|
||
| import ( | ||
| "crypto/cipher" | ||
| "encoding/binary" | ||
|
|
||
| // unsafe needed for go:linkname | ||
| _ "unsafe" | ||
|
|
||
| "github.com/flynn/noise" | ||
| ) | ||
|
|
||
| // EncryptLockNeeded indicates if calls to Encrypt need a lock | ||
| // This is true for fips140 because the Seal function verifies that the | ||
| // nonce is strictly increasing. | ||
| const EncryptLockNeeded = true | ||
|
Collaborator
There was a problem hiding this comment. The other part of
Member
Author
There was a problem hiding this comment. Implemented with a build tag |
||
|
|
||
| // TODO: Use NewGCMWithCounterNonce once available: | ||
| // - https://github.com/golang/go/issues/73110 | ||
| // Using tls.aeadAESGCM gives us the TLS 1.2 GCM, which also verifies | ||
| // that the nonce is strictly increasing. | ||
| // | ||
| //go:linkname aeadAESGCM crypto/tls.aeadAESGCM | ||
| func aeadAESGCM(key, noncePrefix []byte) cipher.AEAD | ||
|
|
||
| type cipherFn struct { | ||
| fn func([32]byte) noise.Cipher | ||
| name string | ||
| } | ||
|
|
||
| func (c cipherFn) Cipher(k [32]byte) noise.Cipher { return c.fn(k) } | ||
| func (c cipherFn) CipherName() string { return c.name } | ||
|
|
||
| // CipherAESGCM is the AES256-GCM AEAD cipher (using aeadAESGCM when fips140 is enabled) | ||
| var CipherAESGCM noise.CipherFunc = cipherFn{cipherAESGCM, "AESGCM"} | ||
|
|
||
| // tls.aeadAESGCM uses a 4 byte static prefix and an 8 byte nonce | ||
| var emptyPrefix = []byte{0, 0, 0, 0} | ||
|
|
||
| func cipherAESGCM(k [32]byte) noise.Cipher { | ||
| gcm := aeadAESGCM(k[:], emptyPrefix) | ||
| return aeadCipher{ | ||
| gcm, | ||
| func(n uint64) []byte { | ||
| // tls.aeadAESGCM uses a 4 byte static prefix and an 8 byte nonce | ||
| var nonce [8]byte | ||
| binary.BigEndian.PutUint64(nonce[:], n) | ||
| return nonce[:] | ||
| }, | ||
| } | ||
| } | ||
|
|
||
| type aeadCipher struct { | ||
| cipher.AEAD | ||
| nonce func(uint64) []byte | ||
| } | ||
|
|
||
| func (c aeadCipher) Encrypt(out []byte, n uint64, ad, plaintext []byte) []byte { | ||
| return c.Seal(out, c.nonce(n), plaintext, ad) | ||
| } | ||
|
|
||
| func (c aeadCipher) Decrypt(out []byte, n uint64, ad, ciphertext []byte) ([]byte, error) { | ||
| return c.Open(out, c.nonce(n), ciphertext, ad) | ||
| } | ||
|
|
||
| func (c aeadCipher) EncryptDanger(out, ad, plaintext []byte, n uint64, nb []byte) ([]byte, error) { | ||
| binary.BigEndian.PutUint64(nb[4:], n) | ||
| out = c.Seal(out, nb[4:], plaintext, ad) | ||
| return out, nil | ||
| } | ||
|
|
||
| func (c aeadCipher) DecryptDanger(out, ad, ciphertext []byte, n uint64, nb []byte) ([]byte, error) { | ||
| binary.BigEndian.PutUint64(nb[4:], n) | ||
| return c.Open(out, nb[4:], ciphertext, ad) | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| //go:build fips140v1.0 | ||
| // +build fips140v1.0 | ||
|
|
||
| package noiseutil | ||
|
|
||
| import ( | ||
| "crypto/fips140" | ||
| "encoding/hex" | ||
| "log" | ||
| "testing" | ||
|
|
||
| "github.com/stretchr/testify/assert" | ||
| ) | ||
|
|
||
| func TestEncryptLockNeeded(t *testing.T) { | ||
| assert.True(t, EncryptLockNeeded) | ||
| } | ||
|
|
||
| // Ensure NewAESGCM validates the nonce is non-repeating | ||
| func TestNewAESGCM(t *testing.T) { | ||
| assert.True(t, fips140.Enabled()) | ||
|
|
||
| key, _ := hex.DecodeString("feffe9928665731c6d6a8f9467308308feffe9928665731c6d6a8f9467308308") | ||
| iv, _ := hex.DecodeString("00000000facedbaddecaf888") | ||
| plaintext, _ := hex.DecodeString("d9313225f88406e5a55909c5aff5269a86a7a9531534f7da2e4c303d8a318a721c3c0c95956809532fcf0e2449a6b525b16aedf5aa0de657ba637b39") | ||
| aad, _ := hex.DecodeString("feedfacedeadbeeffeedfacedeadbeefabaddad2") | ||
| expected, _ := hex.DecodeString("72ce2ea385f88c20d856e9d1248c2ca08562bbe8a61459ffae06ec393540518e9b6b4c40a146053f26a3df83c5384a48d273148b15aba64d970107432b2892741359275676441c1572c3fa9e") | ||
|
|
||
| var keyArray [32]byte | ||
| copy(keyArray[:], key) | ||
| c := CipherAESGCM.Cipher(keyArray) | ||
| aead := c.(aeadCipher).AEAD | ||
|
|
||
| dst := aead.Seal([]byte{}, iv, plaintext, aad) | ||
| log.Printf("%x", dst) | ||
| assert.Equal(t, expected, dst) | ||
|
|
||
| // We expect this to fail since we are re-encrypting with a repeat IV | ||
| assert.PanicsWithValue(t, "crypto/cipher: counter decreased", func() { | ||
| dst = aead.Seal([]byte{}, iv, plaintext, aad) | ||
| }) | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,5 +1,5 @@ | ||
| //go:build !boringcrypto && !fips140v1.0 | ||
| // +build !boringcrypto,!fips140v1.0 | ||
|
|
||
| package noiseutil | ||
|
|
||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,5 +1,5 @@ | ||
| //go:build !boringcrypto && !fips140v1.0 | ||
| // +build !boringcrypto,!fips140v1.0 | ||
|
|
||
| package noiseutil | ||
|
|
||
|
|
||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
boringcryptooutputs with a suffix on the folder like:build/linux-amd64-boringcrypto/nebulafips140outputs to a colliding path with nonfips140:build/linux-amd64/nebula, seems like a good idea to push this intobuild/linux-amd64-fips140/nebula.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
good catch! let me rework this.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
added
release-fips140andbin-fips140for this