]> Cypherpunks repositories - gostls13.git/commit
crypto/fips140: add WithoutEnforcement
authorDaniel Morsing <daniel.morsing@gmail.com>
Mon, 24 Nov 2025 13:08:10 +0000 (13:08 +0000)
committerGopher Robot <gobot@golang.org>
Wed, 26 Nov 2025 22:26:06 +0000 (14:26 -0800)
commit86bbea0cfa72041fb4315eb22099b0bc83caa314
tree3c3a008214e4a9d929a2d8f76f98fe1cf2f323d2
parente2cae9ecdf944a1cc5d8803ff8932180858b8ce6
crypto/fips140: add WithoutEnforcement

WithoutEnforcement lets programs running under GODEBUG=fips140=only
selectively opt out of strict enforcement. This is especially helpful
for non-critical uses of cryptography routines like SHA-1 for content
addressable storage backends (E.g. git).

Fixes #74630

Change-Id: Iabba1f5eb63498db98047aca45e09c5dccf2fbdf
Reviewed-on: https://go-review.googlesource.com/c/go/+/723720
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>
32 files changed:
api/next/74630.txt [new file with mode: 0644]
doc/next/6-stdlib/99-minor/crypto/fips140/74630.md [new file with mode: 0644]
src/crypto/cipher/cbc.go
src/crypto/cipher/cfb.go
src/crypto/cipher/ctr.go
src/crypto/cipher/gcm.go
src/crypto/cipher/ofb.go
src/crypto/des/cipher.go
src/crypto/dsa/dsa.go
src/crypto/ecdh/nist.go
src/crypto/ecdh/x25519.go
src/crypto/ecdsa/ecdsa.go
src/crypto/ecdsa/ecdsa_legacy.go
src/crypto/ed25519/ed25519.go
src/crypto/fips140/enforcement.go [new file with mode: 0644]
src/crypto/fips140/enforcement_test.go [new file with mode: 0644]
src/crypto/fips140/testdata/enforcement_test.go [new file with mode: 0644]
src/crypto/hkdf/hkdf.go
src/crypto/hmac/hmac.go
src/crypto/internal/fips140only/fips140only.go
src/crypto/md5/md5.go
src/crypto/pbkdf2/pbkdf2.go
src/crypto/rand/util.go
src/crypto/rc4/rc4.go
src/crypto/rsa/fips.go
src/crypto/rsa/pkcs1v15.go
src/crypto/rsa/rsa.go
src/crypto/sha1/sha1.go
src/go/build/deps_test.go
src/runtime/fipsbypass.go [new file with mode: 0644]
src/runtime/proc.go
src/runtime/runtime2.go