package

fips140

crypto/internal/fips140/v1.26.0-cd900eea

Subpackages

aes	crypto/internal/fips140/v1.26.0-cd900eea/aes
alias	crypto/internal/fips140/v1.26.0-cd900eea/alias Package alias implements memory aliasing tests.
bigmod	crypto/internal/fips140/v1.26.0-cd900eea/bigmod
check	crypto/internal/fips140/v1.26.0-cd900eea/check Package check implements the FIPS 140 load-time code+data verification.
drbg	crypto/internal/fips140/v1.26.0-cd900eea/drbg Package drbg provides cryptographically secure random bytes usable by FIPS code.
ecdh	crypto/internal/fips140/v1.26.0-cd900eea/ecdh
ecdsa	crypto/internal/fips140/v1.26.0-cd900eea/ecdsa
ed25519	crypto/internal/fips140/v1.26.0-cd900eea/ed25519
edwards25519	crypto/internal/fips140/v1.26.0-cd900eea/edwards25519 Package edwards25519 implements group logic for the twisted Edwards curve
hkdf	crypto/internal/fips140/v1.26.0-cd900eea/hkdf
hmac	crypto/internal/fips140/v1.26.0-cd900eea/hmac Package hmac implements HMAC according to [FIPS 198-1].
mldsa	crypto/internal/fips140/v1.26.0-cd900eea/mldsa
mlkem	crypto/internal/fips140/v1.26.0-cd900eea/mlkem Package mlkem implements the quantum-resistant key encapsulation method ML-KEM (formerly known as Kyber), as specified in [NIST FIPS 203].
nistec	crypto/internal/fips140/v1.26.0-cd900eea/nistec Package nistec implements the elliptic curves from NIST SP 800-186.
pbkdf2	crypto/internal/fips140/v1.26.0-cd900eea/pbkdf2
rsa	crypto/internal/fips140/v1.26.0-cd900eea/rsa
sha256	crypto/internal/fips140/v1.26.0-cd900eea/sha256 Package sha256 implements the SHA-224 and SHA-256 hash algorithms as defined in FIPS 180-4.
sha3	crypto/internal/fips140/v1.26.0-cd900eea/sha3 Package sha3 implements the SHA-3 fixed-output-length hash functions and the SHAKE variable-output-length functions defined by [FIPS 202], as well as the cSHAKE extendable-output-length functions defined by [SP 800-185].
sha512	crypto/internal/fips140/v1.26.0-cd900eea/sha512 Package sha512 implements the SHA-384, SHA-512, SHA-512/224, and SHA-512/256 hash algorithms as defined in FIPS 180-4.
ssh	crypto/internal/fips140/v1.26.0-cd900eea/ssh Package ssh implements the SSH KDF as specified in RFC 4253, Section 7.2 and allowed by SP 800-135 Revision 1.
subtle	crypto/internal/fips140/v1.26.0-cd900eea/subtle
tls12	crypto/internal/fips140/v1.26.0-cd900eea/tls12
tls13	crypto/internal/fips140/v1.26.0-cd900eea/tls13 Package tls13 implements the TLS 1.3 Key Schedule as specified in RFC 8446, Section 7.1 and allowed by FIPS 140-3 IG 2.4.B Resolution 7.

Variables

Enabled source

var Enabled bool

Functions

CAST source

func CAST(name string, f func() error)

CAST runs the named Cryptographic Algorithm Self-Test (if operated in FIPS mode) and aborts the program (stopping the module input/output and entering the "error state") if the self-test fails.

CASTs are mandatory self-checks that must be performed by FIPS 140-3 modules before the algorithm is used. See Implementation Guidance 10.3.A.

The name must not contain commas, colons, hashes, or equal signs.

If a package p calls CAST from its init function, an import of p should also be added to crypto/internal/fips140test. If a package p calls CAST on the first use of the algorithm, an invocation of that algorithm should be added to fipstest.TestConditionals.

Name source

func Name() string

PCT source

func PCT(name string, f func() error)

PCT runs the named Pairwise Consistency Test (if operated in FIPS mode) and aborts the program (stopping the module input/output and entering the "error state") if the test fails.

PCTs are mandatory for every generated (but not imported) key pair, including ephemeral keys (which effectively doubles the cost of key establishment). See Implementation Guidance 10.3.A Additional Comment 1.

The name must not contain commas, colons, hashes, or equal signs.

If a package p calls PCT during key generation, an invocation of that function should be added to fipstest.TestConditionals.

RecordApproved source

func RecordApproved()

RecordApproved is an internal function that records the use of an approved service. It does not override RecordNonApproved calls in the same span.

It should be called by exposed functions that perform a whole cryptographic alrgorithm (e.g. by Sum, not by New, unless a cryptographic Instantiate algorithm is performed) and should be called after any checks that may cause the function to error out or panic.

RecordNonApproved source

func RecordNonApproved()

RecordNonApproved is an internal function that records the use of a non-approved service. It overrides any RecordApproved calls in the same span.

ResetServiceIndicator source

func ResetServiceIndicator()

ResetServiceIndicator clears the service indicator for the running goroutine.

ServiceIndicator source

func ServiceIndicator() bool

ServiceIndicator returns true if and only if all services invoked by this goroutine since the last ResetServiceIndicator call are approved.

If ResetServiceIndicator was not called before by this goroutine, its return value is undefined.

Supported source

func Supported() error

Supported returns an error if FIPS 140-3 mode can't be enabled.

Version source

func Version() string

Version returns the formal version (such as "v1.0.0") if building against a frozen module with GOFIPS140. Otherwise, it returns "latest".