Microsoft Go 1.24 FIPS changes
devblogs.microsoft.com
Microsoft Go 1.24 FIPS changes
1–10 of 70 posts
Re: Microsoft Go 1.24 FIPS changes
#2[deleted]
Re: Microsoft Go 1.24 FIPS changes
#3[deleted]
Re: Microsoft Go 1.24 FIPS changes
#4"What the heck is Microsoft Go?"
> This repository produces a modified version of Go that can be used to build FIPS 140-2 compliant applications. Our goal is to share this implementation with others in the Go community who have the same requirement, and to merge this capability into upstream Go as soon as possible.
It is also the default 'golang' package on Azure Linux 3.0.
Microsoft Go fork: https://github.com/microsoft/go
Issue discussing FIPS implementation: https://github.com/golang/go/issues/69536
Re: Microsoft Go 1.24 FIPS changes
#5"What the heck is Microsoft Go ?" > This repository produces a modified version of Go that can be used to build FIPS 140-2 compliant applications. Our goal is to share this implementation with others in the Go community who have the same requirement, and to merge this capability into upstream Go as soon as possible. It is also the default 'golang' package on Azure Linux 3.0. Microsoft Go fork: https://github.com/micr…
Is Azure Linux 3.0 a rebranding of CBL-mariner
Re: Microsoft Go 1.24 FIPS changes
#6Microsoft Go? I've used Go on windows for years now and this is the first I've heard of this fork. So it only exists because microsoft wants to have a crypto package that complies with an arbitrary regulation? Is there a reason that a better package requires a fork of the entire runtime rather than just, say, a normal Go package? It sounds like it requires cgo to call into third-party libraries, but that's already a common practice in "normal" Go libraries.
One thing I do appreciate is how the relevant issue in the upstream Go repo says: "A number of companies must comply with them, for example as part of a broader FedRAMP compliance posture. (If that's not you, you can ignore this. Run!)" [1]
Apparently I'm just not the target audience. Sounds like I'm correct in assuming it's security theater at best, and an avenue for new backdoors at worst.
Re: Microsoft Go 1.24 FIPS changes
#7IIRC, the FIPS-compliant Go crypto project was a Filippo Valsorda joint. I hate it, but I'm glad someone sane managed it.
Re: Microsoft Go 1.24 FIPS changes
#8"What the heck is Microsoft Go ?" > This repository produces a modified version of Go that can be used to build FIPS 140-2 compliant applications. Our goal is to share this implementation with others in the Go community who have the same requirement, and to merge this capability into upstream Go as soon as possible. It is also the default 'golang' package on Azure Linux 3.0. Microsoft Go fork: https://github.com/micr…
[deleted]
Re: Microsoft Go 1.24 FIPS changes
#9IIRC, the FIPS-compliant Go crypto project was a Filippo Valsorda joint. I hate it, but I'm glad someone sane managed it.
https://github.com/golang/go/issues/69536?ref=words.filippo....
https://words.filippo.io/dispatches/fips-hkdf/
Thought one of the Filippo/Go/FIPS posts had a big thread but doesn't look like it and/or can't find it.
Re: Microsoft Go 1.24 FIPS changes
#10Microsoft Go? I've used Go on windows for years now and this is the first I've heard of this fork. So it only exists because microsoft wants to have a crypto package that complies with an arbitrary regulation? Is there a reason that a better package requires a fork of the entire runtime rather than just, say, a normal Go package? It sounds like it requires cgo to call into third-party libraries, but that's already a…
[deleted]