Implement FIPS-compatible crypto for Windows using platform-native crypto library

[dagood]

Use a native Windows crypto library (CNG) to implement Go's crypto library in the boring branches, so we can rely on the native library's FIPS compatibility.

This is the same approach we took on Linux, where we rely on OpenSSL crypto's FIPS compatibility.

Progress:

• CI tests: Implement sha and rand go-crypto-winnative#2
• rand: Implement sha and rand go-crypto-winnative#2
• sha:
  • sha1: Implement sha and rand go-crypto-winnative#2
  • sha224: Missing algorithms go-crypto-winnative#4
  • sha256: Implement sha and rand go-crypto-winnative#2
  • sha384: Implement sha and rand go-crypto-winnative#2
  • sha512: Implement sha and rand go-crypto-winnative#2
• hmac: Implement HMAC go-crypto-winnative#3
• rsa
  • OAEP padding: Implement RSA encrypt/decrypt and sign/verify go-crypto-winnative#6
  • PKCS1 padding: Implement RSA encrypt/decrypt and sign/verify go-crypto-winnative#6
  • PSS padding: Implement RSA encrypt/decrypt and sign/verify go-crypto-winnative#6
  • No padding: Implement RSA encrypt/decrypt and sign/verify go-crypto-winnative#6
• ecdsa
• aes
  • ECB mode: Implement AES ECB, CBC and GCM modes go-crypto-winnative#5
  • CBC mode: Implement AES ECB, CBC and GCM modes go-crypto-winnative#5
  • GCM mode: Implement AES ECB, CBC and GCM modes go-crypto-winnative#5
  • CRT mode: Missing algorithms go-crypto-winnative#4
• vendor into Go toolchain: Add CNG crypto backend #645

[qmuntal]

Windows work is happening at https://github.com/microsoft/go-crypto-winnative

[jdrews]

Any update here? I'm very interested in this work!

I tried following the link provided and it returns a 404.
https://github.com/microsoft/go-crypto-winnative

[jaredpar]

Any update here?

The Windows support for FIPS is still under way. Had to pause it briefly to work on a different project but that has completed and we're back to getting our Windows FIPS implementation completed.

I'm very interested in this work!

Curious: where are you planning on using this? Trying to get a better sense of the people / projects that are taking a dependency on this work.

I tried following the link provided and it returns a 404.
https://github.com/microsoft/go-crypto-winnative

That should be public fairly soon.

[dagood]

https://github.com/microsoft/go-crypto-winnative

That should be public fairly soon.

The repo is now public. 🎉

[jdrews]

@jaredpar Sure! I have a few projects where I need to deploy FIPS enabled go microservices on Windows hosts at the edge of unreliable networks to comply with security requirements (FIPS 140-2). Currently I use BoringCrypto toolchains to compile the go microservices with FIPS and run them on Linux based virtual machines or docker containers. But being able to run these services native on the Windows hosts without requiring Linux virtual machines or docker containers would greatly reduce the compute usage and also simplify the deployment architecture.