Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

crypto: upgrade to BoringCrypto fips-20220613 and enable TLS 1.3 [1.20 backport] #64718

Closed
gopherbot opened this issue Dec 14, 2023 · 5 comments
Closed

crypto: upgrade to BoringCrypto fips-20220613 and enable TLS 1.3 [1.20 backport] #64718

gopherbot opened this issue Dec 14, 2023 · 5 comments
Labels
CherryPickApproved Used during the release process for point releases
Milestone
Go1.20.13

Comments

@gopherbot
Copy link
Contributor

@FiloSottile requested issue #64717 to be considered for backport to the next 1.20 minor release.

@gopherbot please open backport issues. All supported Go versions need to be able to comply with NIST SP 800-52 Rev. 2 in GOEXPERIMENT=boringcrypto mode.

/cc @golang/release @golang/security @rsc
@gopherbot gopherbot added the CherryPickCandidate Used during the release process for point releases label Dec 14, 2023
@gopherbot gopherbot mentioned this issue Dec 14, 2023
Closed
@gopherbot gopherbot added this to the Go1.20.13 milestone Dec 14, 2023
@cagedmantis cagedmantis added the CherryPickApproved Used during the release process for point releases label Dec 20, 2023
@gopherbot gopherbot removed the CherryPickCandidate Used during the release process for point releases label Dec 20, 2023
@mdempsky
Copy link
Contributor

mdempsky commented Jan 3, 2024

@FiloSottile Do you plan to create a backport CL? Thanks.

@FiloSottile
Copy link
Contributor

Sorry, I had missed the transition to CherryPickApproved. Mailing it today.

@gopherbot
Copy link
Contributor Author

Change https://go.dev/cl/553875 mentions this issue: [release-branch.go1.20] crypto/internal/boring: upgrade module to fips-20220613

@gopherbot
Copy link
Contributor Author

Change https://go.dev/cl/553876 mentions this issue: [release-branch.go1.20] crypto/tls: align FIPS-only mode with BoringSSL policy

@gopherbot
Copy link
Contributor Author

Closed by merging 9e4abed to release-branch.go1.20.

gopherbot pushed a commit that referenced this issue Jan 4, 2024
@FiloSottile @gopherbot
[release-branch.go1.20] crypto/internal/boring: upgrade module to fip…
9e4abed 
…s-20220613

Also, add EVP_aead_aes_*_gcm_tls13 to the build, which we will need in a
following CL, to avoid rebuilding the syso twice.

Updates #64717
Updates #62372
Updates #64718

Change-Id: Ie4d853ad9b914c1095cad60694a1ae6f77dc22ce
Cq-Include-Trybots: luci.golang.try:go1.20-linux-amd64-boringcrypto
Reviewed-on: https://go-review.googlesource.com/c/go/+/549695
Reviewed-by: Than McIntosh <[email protected]>
Reviewed-by: Roland Shoemaker <[email protected]>
Reviewed-on: https://go-review.googlesource.com/c/go/+/553875
Auto-Submit: Matthew Dempsky <[email protected]>
Reviewed-by: Matthew Dempsky <[email protected]>
LUCI-TryBot-Result: Go LUCI <[email protected]>
gopherbot pushed a commit that referenced this issue Jan 4, 2024
@FiloSottile @gopherbot
[release-branch.go1.20] crypto/tls: align FIPS-only mode with BoringS…
5c38c04 
…SL policy

This enables TLS 1.3, disables P-521, and disables non-ECDHE suites.

Updates #64717
Updates #62372
Fixes #64718

Change-Id: I3a65b239ef0198bbdbe5e55e0810e7128f90a091
Reviewed-on: https://go-review.googlesource.com/c/go/+/549975
Reviewed-by: Roland Shoemaker <[email protected]>
LUCI-TryBot-Result: Go LUCI <[email protected]>
Reviewed-by: Than McIntosh <[email protected]>
Reviewed-on: https://go-review.googlesource.com/c/go/+/553876
Run-TryBot: Matthew Dempsky <[email protected]>
Auto-Submit: Matthew Dempsky <[email protected]>
Reviewed-by: Matthew Dempsky <[email protected]>
TryBot-Result: Gopher Robot <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
CherryPickApproved Used during the release process for point releases
Projects
None yet
Milestone
Go1.20.13
Development

No branches or pull requests
4 participants
@mdempsky @cagedmantis @FiloSottile @gopherbot