6 ms·

Microsoft Maintains Go Fork for FIPS 140-2 Support

43 points by dschofie 2y ago

entropyie 2y ago
I'd be happy if just made Defender stop detecting all my go binaries as Malware...
deleted 2y ago
[deleted]
interroboink 2y ago
Does anyone with FIPS experience know what sort of changes are entailed by those requirements? This repo doesn't seem to list what sort of high-level/conceptual changes are involved. I could look at the diff, but that sounds exhausting :Þ
- bpicolo 2y ago
  They document exactly that https://github.com/microsoft/go/tree/microsoft/main/eng/doc/fips https://github.com/microsoft/go/tree/microsoft/main/eng/doc/...
- YZF 2y ago
  The general theme is that you need to be using approved ciphers and you need to have your key management code certified by some external entity. It is an exhausting process ;)
metadat 2y ago
There used to be the GO FIPS branch: https://github.com/golang/go/tree/dev.boringcrypto/misc/boring https://github.com/golang/go/tree/dev.boringcrypto/misc/bori... But it looks dead for some time. However https://github.com/golang-fips/go https://github.com/golang-fips/go sprung up to take it's place. I wonder why microsoft prefers to maintain it's own in entirety rather than share a piece of the burden.
- abtinf 2y ago
  > Our goal is to share this implementation with others in the Go community who have the same requirement, and to merge this capability into upstream Go as soon as possible. From the readme.
- gct 2y ago
  EEE
  - bogantech 2y ago
    Ah yes they're going to extinguish Go with a checks notes... open-source fork
  - metadat 2y ago
    What?
    - camkego 2y ago
      From Wikipedia: https://en.wikipedia.org/wiki/Embrace,_extend,_and_extinguish https://en.wikipedia.org/wiki/Embrace,_extend,_and_extinguis... "Embrace, extend, and extinguish" (EEE),[1] also known as "embrace, extend, and exterminate",[2] is a phrase that the U.S. Department of Justice found[3] was used internally by Microsoft[4] to describe its strategy for entering product categories involving widely used open standards, extending those standards with proprietary capabilities, and using the differences to strongly disadvantage its competitors. Please see the Wiki article for the full deal including footnotes.
  - cosmotic 2y ago
    It's not fair to say EEE in response to every apparently good thing Microsoft does.
purpleidea 2y ago
If this doesn't also _add_ some "accidental" backdoor, I'd be surprised. Microsoft's security reputation is so flawed, that some parts simply must be intentional, or coerced. Don't use this repo. Very interesting TIL about golang at Microsoft. Thanks for sharing.
- tptacek 2y ago
  It's built from source. You can just diff it. Of course, you don't have to, because they provide the patches. Don't use any FIPS branch of any platform, because FIPS is terrible. But the argument presented here seems facile.
  - SAI_Peregrinus 2y ago
    FIPS is terrible, except that sometimes if you shout "FIPS 140 compliance for US gov contracts" enough into the corporate hierarchy you eventually get the budget to implement any security whatsoever, even though it's just FIPS. If you're not trying to get US government contracts that require it, don't bother with FIPS. It mandates older algorithms; they're mostly secure enough but not as performant and there are a lot more footguns. FIPS 140-3 fixed a few, but not all.
    - dadrian 2y ago
      There's a difference between FIPS approved algorithms, which are actually pretty broad and well-selected these days, and FIPS validated implementations, which are at best a PITA and often actively harmful. Very rarely do you actually need a FIPS-validated implementation.
- nvy 2y ago
  >Microsoft's security reputation is so flawed, that some parts simply must be intentional, or coerced. They are a lot better than they used to be. They went through a trial by fire in the 90s and early 00s and came through for the better. It's worth noting that classified computer systems in the military-industrial complex run Windows, and not Linux, nor do they run the security cosplay that is OpenBSD.
deleted 2y ago
[deleted]
korginator 2y ago
You would be interested in this if you need the 'crypto' library to work in a FIPS 140-2 compliant way. You can switch on / off this mode by setting the runtime variable GOFIPS=1 before running your Go program [1]. Nice. It looks like the Go community officially has no plans to support FIPS140-2 any time, so I'm glad to see this alternative. [1] https://github.com/microsoft/go/tree/microsoft/main/eng/doc/fips#usage-runtime https://github.com/microsoft/go/tree/microsoft/main/eng/doc/...

43 points by dschofie 2y ago

entropyie 2y ago

I'd be happy if just made Defender stop detecting all my go binaries as Malware...

deleted 2y ago

[deleted]

interroboink 2y ago

Does anyone with FIPS experience know what sort of changes are entailed by those requirements? This repo doesn't seem to list what sort of high-level/conceptual changes are involved. I could look at the diff, but that sounds exhausting :Þ

bpicolo 2y ago
They document exactly that https://github.com/microsoft/go/tree/microsoft/main/eng/doc/fips https://github.com/microsoft/go/tree/microsoft/main/eng/doc/...
YZF 2y ago
The general theme is that you need to be using approved ciphers and you need to have your key management code certified by some external entity. It is an exhausting process ;)

metadat 2y ago

There used to be the GO FIPS branch: https://github.com/golang/go/tree/dev.boringcrypto/misc/boring https://github.com/golang/go/tree/dev.boringcrypto/misc/bori... But it looks dead for some time. However https://github.com/golang-fips/go https://github.com/golang-fips/go sprung up to take it's place. I wonder why microsoft prefers to maintain it's own in entirety rather than share a piece of the burden.

abtinf 2y ago
> Our goal is to share this implementation with others in the Go community who have the same requirement, and to merge this capability into upstream Go as soon as possible. From the readme.
gct 2y ago
EEE
- bogantech 2y ago
  Ah yes they're going to extinguish Go with a checks notes... open-source fork
- metadat 2y ago
  What?
  - camkego 2y ago
    From Wikipedia: https://en.wikipedia.org/wiki/Embrace,_extend,_and_extinguish https://en.wikipedia.org/wiki/Embrace,_extend,_and_extinguis... "Embrace, extend, and extinguish" (EEE),[1] also known as "embrace, extend, and exterminate",[2] is a phrase that the U.S. Department of Justice found[3] was used internally by Microsoft[4] to describe its strategy for entering product categories involving widely used open standards, extending those standards with proprietary capabilities, and using the differences to strongly disadvantage its competitors. Please see the Wiki article for the full deal including footnotes.
- cosmotic 2y ago
  It's not fair to say EEE in response to every apparently good thing Microsoft does.

purpleidea 2y ago

If this doesn't also _add_ some "accidental" backdoor, I'd be surprised. Microsoft's security reputation is so flawed, that some parts simply must be intentional, or coerced. Don't use this repo. Very interesting TIL about golang at Microsoft. Thanks for sharing.

tptacek 2y ago
It's built from source. You can just diff it. Of course, you don't have to, because they provide the patches. Don't use any FIPS branch of any platform, because FIPS is terrible. But the argument presented here seems facile.
- SAI_Peregrinus 2y ago
  FIPS is terrible, except that sometimes if you shout "FIPS 140 compliance for US gov contracts" enough into the corporate hierarchy you eventually get the budget to implement any security whatsoever, even though it's just FIPS. If you're not trying to get US government contracts that require it, don't bother with FIPS. It mandates older algorithms; they're mostly secure enough but not as performant and there are a lot more footguns. FIPS 140-3 fixed a few, but not all.
  - dadrian 2y ago
    There's a difference between FIPS approved algorithms, which are actually pretty broad and well-selected these days, and FIPS validated implementations, which are at best a PITA and often actively harmful. Very rarely do you actually need a FIPS-validated implementation.
nvy 2y ago
>Microsoft's security reputation is so flawed, that some parts simply must be intentional, or coerced. They are a lot better than they used to be. They went through a trial by fire in the 90s and early 00s and came through for the better. It's worth noting that classified computer systems in the military-industrial complex run Windows, and not Linux, nor do they run the security cosplay that is OpenBSD.

deleted 2y ago

[deleted]

korginator 2y ago

You would be interested in this if you need the 'crypto' library to work in a FIPS 140-2 compliant way. You can switch on / off this mode by setting the runtime variable GOFIPS=1 before running your Go program [1]. Nice. It looks like the Go community officially has no plans to support FIPS140-2 any time, so I'm glad to see this alternative. [1] https://github.com/microsoft/go/tree/microsoft/main/eng/doc/fips#usage-runtime https://github.com/microsoft/go/tree/microsoft/main/eng/doc/...