Microsoft Maintains Go Fork for FIPS 140-2 Support
1–10 of 21 posts
Re: Microsoft Maintains Go Fork for FIPS 140-2 Support
#2[deleted]
Re: Microsoft Maintains Go Fork for FIPS 140-2 Support
#3Does anyone with FIPS experience know what sort of changes are entailed by those requirements?
This repo doesn't seem to list what sort of high-level/conceptual changes are involved. I could look at the diff, but that sounds exhausting :Þ
Re: Microsoft Maintains Go Fork for FIPS 140-2 Support
#4Does anyone with FIPS experience know what sort of changes are entailed by those requirements? This repo doesn't seem to list what sort of high-level/conceptual changes are involved. I could look at the diff, but that sounds exhausting :Þ
They document exactly that
https://github.com/microsoft/go/tree/microsoft/main/eng/doc/...
Re: Microsoft Maintains Go Fork for FIPS 140-2 Support
#5There used to be the GO FIPS branch:
https://github.com/golang/go/tree/dev.boringcrypto/misc/bori...
But it looks dead for some time.
However https://github.com/golang-fips/go sprung up to take it's place.
I wonder why microsoft prefers to maintain it's own in entirety rather than share a piece of the burden.
Re: Microsoft Maintains Go Fork for FIPS 140-2 Support
#6If this doesn't also _add_ some "accidental" backdoor, I'd be surprised.
Microsoft's security reputation is so flawed, that some parts simply must be intentional, or coerced.
Don't use this repo. Very interesting TIL about golang at Microsoft. Thanks for sharing.
Re: Microsoft Maintains Go Fork for FIPS 140-2 Support
#7If this doesn't also _add_ some "accidental" backdoor, I'd be surprised. Microsoft's security reputation is so flawed, that some parts simply must be intentional, or coerced. Don't use this repo. Very interesting TIL about golang at Microsoft. Thanks for sharing.
It's built from source. You can just diff it. Of course, you don't have to, because they provide the patches.
Don't use any FIPS branch of any platform, because FIPS is terrible. But the argument presented here seems facile.
Re: Microsoft Maintains Go Fork for FIPS 140-2 Support
#8There used to be the GO FIPS branch: https://github.com/golang/go/tree/dev.boringcrypto/misc/bori... But it looks dead for some time. However https://github.com/golang-fips/go sprung up to take it's place. I wonder why microsoft prefers to maintain it's own in entirety rather than share a piece of the burden.
> Our goal is to share this implementation with others in the Go community who have the same requirement, and to merge this capability into upstream Go as soon as possible.
From the readme.
Re: Microsoft Maintains Go Fork for FIPS 140-2 Support
#9[deleted]
Re: Microsoft Maintains Go Fork for FIPS 140-2 Support
#10If this doesn't also _add_ some "accidental" backdoor, I'd be surprised. Microsoft's security reputation is so flawed, that some parts simply must be intentional, or coerced. Don't use this repo. Very interesting TIL about golang at Microsoft. Thanks for sharing.
>Microsoft's security reputation is so flawed, that some parts simply must be intentional, or coerced.
They are a lot better than they used to be. They went through a trial by fire in the 90s and early 00s and came through for the better.
It's worth noting that classified computer systems in the military-industrial complex run Windows, and not Linux, nor do they run the security cosplay that is OpenBSD.