英文:
Go dev.boringcrypto branch - x/crypto library FIPS 140-2 compliance
问题
dev.boringcrypto分支是Go语言的一个分支，它用FIPS验证版本替换了内置的加密模块：
我们在Google内部一直在使用Go的一个分支，该分支使用BoringCrypto（BoringSSL的核心）来进行各种加密原语的工作，以进一步支持与FIPS 140-2相关的工作。我们听说一些外部的Go用户也对这个代码感兴趣，所以这个分支保存了使Go使用BoringCrypto的补丁。
通过查看源代码，我可以看到对低级加密代码的修改。然而，我一直在使用的Go包都使用x/crypto库，但我在这个分支中没有看到任何与它相关的引用。我想要一些关于这个库与FIPS 140-2的适用性的澄清 - 如果我使用boringcrypto构建的Go项目编译使用了x/crypto的代码，那么这个库是否也会符合FIPS标准？
如果不是这样的话 - 为什么？如果Go有一个维护的经过FIPS验证的分支，为什么一个基本的加密库没有相同的修改呢？
英文:
The dev.boringcrypto branch of Go replaces the built-in crypto modules with a FIPS-verified version:
> We have been working inside Google on a fork of Go that uses
BoringCrypto (the core of BoringSSL) for various crypto
primitives, in furtherance of some work related to FIPS 140-2.
We have heard that some external users of Go would be interested in
this code as well, so this branch holds the patches to make Go use
BoringCrypto.
Poking around through the source code, I can see the modifications to the low-level crypto code. However, the Go packages that I've been using all use the x/crypto library, which I couldn't see any references to in the branch on first look. I would like some clarification around the suitability of this library in relation to FIPS 140-2 - if I compiled a project that uses x/crypto with a boringcrypto Go build, would the library become FIPS-compliant as well?
If this isn't the case - why not? If Go has a maintained FIPS-verified branch, why wouldn't a fundamental crypto library also have the same modifications?
答案1
得分: 2
一旦你正在使用的库通过了活动的CMVP（密码模块验证计划）验证，那么你就可以确保它符合FIPS 140-2标准。
请记住，与FIPS相关的概念中有"合规性"和"认可"两个概念。
"合规性"是指底层密码算法在批准的密码原语列表中，比如AES256-CBC。
"认可/验证"是指底层库经过NIST认可的实验室进行了专门的审计。
对于FIPS 140-2的生产使用（如FedRAMP等），你必须依赖于后者。
看起来你需要的是CMVP编号3753。
对证书底层参数的任何修改都会使认可失效。
英文:
Once there is an active CMVP (Cryptographic module validation programme), for the library you are using, then you can be assured of the FIPS 140-2 validation.
Remember, there are both "compliance" and "accreditation" concepts spoken about in relation to FIPS.
"Compliance" is where the underlying cipher is on the list of approved cryptographic primitives, i.e. AES256-CBC.
"Accreditation/Validation" is where the underlying library has been specifically audited by a NIST approved lab.
It's the latter you must rely upon for FIPS 140-2 production use (FedRAMP etc).
Looks like CMVP #3753 is what you need.
Any modification to the parameters underlying the certificate invalidates the accreditation.
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库，让每个人都能够通过互相帮助和分享经验来进步。
评论