Skip to content

Commit 1d50cae

Browse files
aeadaead
authored
remove support for FIPS 140-2 with boringcrypto (minio#21292)
This commit removes FIPS 140-2 related code for the following reasons: - FIPS 140-2 is a compliance, not a security requirement. Being FIPS 140-2 compliant has no security implication on its own. From a tech. perspetive, a FIPS 140-2 compliant implementation is not necessarily secure and a non-FIPS 140-2 compliant implementation is not necessarily insecure. It depends on the concret design and crypto primitives/constructions used. - The boringcrypto branch used to achieve FIPS 140-2 compliance was never officially supported by the Go team and is now in maintainance mode. It is replaced by a built-in FIPS 140-3 module. It will be removed eventually. Ref: golang/go#69536 - FIPS 140-2 modules are no longer re-certified after Sep. 2026. Ref: https://csrc.nist.gov/projects/cryptographic-module-validation-program Signed-off-by: Andreas Auernhammer <[email protected]>
1 parent c0a3395 commit 1d50cae

21 files changed

+52
-294
lines changed

‎.github/workflows/go-fips.yml

Lines changed: 0 additions & 59 deletions
This file was deleted.

‎README.fips.md

Lines changed: 0 additions & 7 deletions
This file was deleted.

‎cmd/bucket-metadata.go

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,6 @@ import (
3838
"github.com/minio/minio/internal/bucket/versioning"
3939
"github.com/minio/minio/internal/crypto"
4040
"github.com/minio/minio/internal/event"
41-
"github.com/minio/minio/internal/fips"
4241
"github.com/minio/minio/internal/kms"
4342
"github.com/minio/minio/internal/logger"
4443
"github.com/minio/pkg/v3/policy"
@@ -556,7 +555,7 @@ func encryptBucketMetadata(ctx context.Context, bucket string, input []byte, kms
556555
objectKey := crypto.GenerateKey(key.Plaintext, rand.Reader)
557556
sealedKey := objectKey.Seal(key.Plaintext, crypto.GenerateIV(rand.Reader), crypto.S3.String(), bucket, "")
558557
crypto.S3.CreateMetadata(metadata, key.KeyID, key.Ciphertext, sealedKey)
559-
_, err = sio.Encrypt(outbuf, bytes.NewBuffer(input), sio.Config{Key: objectKey[:], MinVersion: sio.Version20, CipherSuites: fips.DARECiphers()})
558+
_, err = sio.Encrypt(outbuf, bytes.NewBuffer(input), sio.Config{Key: objectKey[:], MinVersion: sio.Version20})
560559
if err != nil {
561560
return output, metabytes, err
562561
}
@@ -590,6 +589,6 @@ func decryptBucketMetadata(input []byte, bucket string, meta map[string]string,
590589
}
591590

592591
outbuf := bytes.NewBuffer(nil)
593-
_, err = sio.Decrypt(outbuf, bytes.NewBuffer(input), sio.Config{Key: objectKey[:], MinVersion: sio.Version20, CipherSuites: fips.DARECiphers()})
592+
_, err = sio.Decrypt(outbuf, bytes.NewBuffer(input), sio.Config{Key: objectKey[:], MinVersion: sio.Version20})
594593
return outbuf.Bytes(), err
595594
}

‎cmd/encryption-v1.go

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,6 @@ import (
3737
"github.com/minio/kms-go/kes"
3838
"github.com/minio/minio/internal/crypto"
3939
"github.com/minio/minio/internal/etag"
40-
"github.com/minio/minio/internal/fips"
4140
"github.com/minio/minio/internal/hash"
4241
"github.com/minio/minio/internal/hash/sha256"
4342
xhttp "github.com/minio/minio/internal/http"
@@ -427,7 +426,7 @@ func newEncryptReader(ctx context.Context, content io.Reader, kind crypto.Type,
427426
return nil, crypto.ObjectKey{}, err
428427
}
429428

430-
reader, err := sio.EncryptReader(content, sio.Config{Key: objectEncryptionKey[:], MinVersion: sio.Version20, CipherSuites: fips.DARECiphers()})
429+
reader, err := sio.EncryptReader(content, sio.Config{Key: objectEncryptionKey[:], MinVersion: sio.Version20})
431430
if err != nil {
432431
return nil, crypto.ObjectKey{}, crypto.ErrInvalidCustomerKey
433432
}
@@ -570,7 +569,6 @@ func newDecryptReaderWithObjectKey(client io.Reader, objectEncryptionKey []byte,
570569
reader, err := sio.DecryptReader(client, sio.Config{
571570
Key: objectEncryptionKey,
572571
SequenceNumber: seqNumber,
573-
CipherSuites: fips.DARECiphers(),
574572
})
575573
if err != nil {
576574
return nil, crypto.ErrInvalidCustomerKey
@@ -1062,7 +1060,7 @@ func metadataEncrypter(key crypto.ObjectKey) objectMetaEncryptFn {
10621060
var buffer bytes.Buffer
10631061
mac := hmac.New(sha256.New, key[:])
10641062
mac.Write([]byte(baseKey))
1065-
if _, err := sio.Encrypt(&buffer, bytes.NewReader(data), sio.Config{Key: mac.Sum(nil), CipherSuites: fips.DARECiphers()}); err != nil {
1063+
if _, err := sio.Encrypt(&buffer, bytes.NewReader(data), sio.Config{Key: mac.Sum(nil)}); err != nil {
10661064
logger.CriticalIf(context.Background(), errors.New("unable to encrypt using object key"))
10671065
}
10681066
return buffer.Bytes()
@@ -1085,7 +1083,7 @@ func (o *ObjectInfo) metadataDecrypter(h http.Header) objectMetaDecryptFn {
10851083
}
10861084
mac := hmac.New(sha256.New, key)
10871085
mac.Write([]byte(baseKey))
1088-
return sio.DecryptBuffer(nil, input, sio.Config{Key: mac.Sum(nil), CipherSuites: fips.DARECiphers()})
1086+
return sio.DecryptBuffer(nil, input, sio.Config{Key: mac.Sum(nil)})
10891087
}
10901088
}
10911089

‎cmd/grid.go

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ import (
2222
"crypto/tls"
2323
"sync/atomic"
2424

25-
"github.com/minio/minio/internal/fips"
25+
"github.com/minio/minio/internal/crypto"
2626
"github.com/minio/minio/internal/grid"
2727
xhttp "github.com/minio/minio/internal/http"
2828
"github.com/minio/minio/internal/rest"
@@ -52,8 +52,8 @@ func initGlobalGrid(ctx context.Context, eps EndpointServerPools) error {
5252
newCachedAuthToken(),
5353
&tls.Config{
5454
RootCAs: globalRootCAs,
55-
CipherSuites: fips.TLSCiphers(),
56-
CurvePreferences: fips.TLSCurveIDs(),
55+
CipherSuites: crypto.TLSCiphers(),
56+
CurvePreferences: crypto.TLSCurveIDs(),
5757
}),
5858
Local: local,
5959
Hosts: hosts,
@@ -85,8 +85,8 @@ func initGlobalLockGrid(ctx context.Context, eps EndpointServerPools) error {
8585
newCachedAuthToken(),
8686
&tls.Config{
8787
RootCAs: globalRootCAs,
88-
CipherSuites: fips.TLSCiphers(),
89-
CurvePreferences: fips.TLSCurveIDs(),
88+
CipherSuites: crypto.TLSCiphers(),
89+
CurvePreferences: crypto.TLSCurveIDs(),
9090
}, grid.RouteLockPath),
9191
Local: local,
9292
Hosts: hosts,

‎cmd/object-multipart-handlers.go

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,6 @@ import (
4242
"github.com/minio/minio/internal/crypto"
4343
"github.com/minio/minio/internal/etag"
4444
"github.com/minio/minio/internal/event"
45-
"github.com/minio/minio/internal/fips"
4645
"github.com/minio/minio/internal/handlers"
4746
"github.com/minio/minio/internal/hash"
4847
"github.com/minio/minio/internal/hash/sha256"
@@ -527,9 +526,8 @@ func (api objectAPIHandlers) CopyObjectPartHandler(w http.ResponseWriter, r *htt
527526

528527
partEncryptionKey := objectEncryptionKey.DerivePartKey(uint32(partID))
529528
encReader, err := sio.EncryptReader(reader, sio.Config{
530-
Key: partEncryptionKey[:],
531-
CipherSuites: fips.DARECiphers(),
532-
Nonce: &nonce,
529+
Key: partEncryptionKey[:],
530+
Nonce: &nonce,
533531
})
534532
if err != nil {
535533
writeErrorResponse(ctx, w, toAPIError(ctx, err), r.URL)
@@ -825,9 +823,8 @@ func (api objectAPIHandlers) PutObjectPartHandler(w http.ResponseWriter, r *http
825823
copy(nonce[:], tmp[:12])
826824

827825
reader, err = sio.EncryptReader(in, sio.Config{
828-
Key: partEncryptionKey[:],
829-
CipherSuites: fips.DARECiphers(),
830-
Nonce: &nonce,
826+
Key: partEncryptionKey[:],
827+
Nonce: &nonce,
831828
})
832829
if err != nil {
833830
writeErrorResponse(ctx, w, toAPIError(ctx, err), r.URL)

‎cmd/update.go

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -50,8 +50,13 @@ const (
5050
updateTimeout = 10 * time.Second
5151
)
5252

53-
// For windows our files have .exe additionally.
54-
var minioReleaseWindowsInfoURL = MinioReleaseURL + "minio.exe.sha256sum"
53+
var (
54+
// Newer official download info URLs appear earlier below.
55+
minioReleaseInfoURL = MinioReleaseURL + "minio.sha256sum"
56+
57+
// For windows our files have .exe additionally.
58+
minioReleaseWindowsInfoURL = MinioReleaseURL + "minio.exe.sha256sum"
59+
)
5560

5661
// minioVersionToReleaseTime - parses a standard official release
5762
// MinIO version string.

‎cmd/update_fips.go

Lines changed: 0 additions & 24 deletions
This file was deleted.

‎cmd/update_nofips.go

Lines changed: 0 additions & 24 deletions
This file was deleted.

‎cmd/utils.go

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ import (
5252
"github.com/minio/minio/internal/config/api"
5353
xtls "github.com/minio/minio/internal/config/identity/tls"
5454
"github.com/minio/minio/internal/config/storageclass"
55-
"github.com/minio/minio/internal/fips"
55+
"github.com/minio/minio/internal/crypto"
5656
"github.com/minio/minio/internal/handlers"
5757
"github.com/minio/minio/internal/hash"
5858
xhttp "github.com/minio/minio/internal/http"
@@ -612,8 +612,8 @@ func NewInternodeHTTPTransport(maxIdleConnsPerHost int) func() http.RoundTripper
612612
LookupHost: globalDNSCache.LookupHost,
613613
DialTimeout: rest.DefaultTimeout,
614614
RootCAs: globalRootCAs,
615-
CipherSuites: fips.TLSCiphers(),
616-
CurvePreferences: fips.TLSCurveIDs(),
615+
CipherSuites: crypto.TLSCiphers(),
616+
CurvePreferences: crypto.TLSCurveIDs(),
617617
EnableHTTP2: false,
618618
TCPOptions: globalTCPOptions,
619619
}.NewInternodeHTTPTransport(maxIdleConnsPerHost)
@@ -626,8 +626,8 @@ func NewHTTPTransportWithClientCerts(clientCert, clientKey string) http.RoundTri
626626
LookupHost: globalDNSCache.LookupHost,
627627
DialTimeout: defaultDialTimeout,
628628
RootCAs: globalRootCAs,
629-
CipherSuites: fips.TLSCiphersBackwardCompatible(),
630-
CurvePreferences: fips.TLSCurveIDs(),
629+
CipherSuites: crypto.TLSCiphersBackwardCompatible(),
630+
CurvePreferences: crypto.TLSCurveIDs(),
631631
TCPOptions: globalTCPOptions,
632632
EnableHTTP2: false,
633633
}
@@ -665,8 +665,8 @@ func NewHTTPTransportWithTimeout(timeout time.Duration) *http.Transport {
665665
DialTimeout: defaultDialTimeout,
666666
RootCAs: globalRootCAs,
667667
TCPOptions: globalTCPOptions,
668-
CipherSuites: fips.TLSCiphersBackwardCompatible(),
669-
CurvePreferences: fips.TLSCurveIDs(),
668+
CipherSuites: crypto.TLSCiphersBackwardCompatible(),
669+
CurvePreferences: crypto.TLSCurveIDs(),
670670
EnableHTTP2: false,
671671
}.NewHTTPTransportWithTimeout(timeout)
672672
}
@@ -677,8 +677,8 @@ func NewRemoteTargetHTTPTransport(insecure bool) func() *http.Transport {
677677
return xhttp.ConnSettings{
678678
LookupHost: globalDNSCache.LookupHost,
679679
RootCAs: globalRootCAs,
680-
CipherSuites: fips.TLSCiphersBackwardCompatible(),
681-
CurvePreferences: fips.TLSCurveIDs(),
680+
CipherSuites: crypto.TLSCiphersBackwardCompatible(),
681+
CurvePreferences: crypto.TLSCurveIDs(),
682682
TCPOptions: globalTCPOptions,
683683
EnableHTTP2: false,
684684
}.NewRemoteTargetHTTPTransport(insecure)
@@ -986,11 +986,11 @@ func newTLSConfig(getCert certs.GetCertificateFunc) *tls.Config {
986986
}
987987

988988
if secureCiphers := env.Get(api.EnvAPISecureCiphers, config.EnableOn) == config.EnableOn; secureCiphers {
989-
tlsConfig.CipherSuites = fips.TLSCiphers()
989+
tlsConfig.CipherSuites = crypto.TLSCiphers()
990990
} else {
991-
tlsConfig.CipherSuites = fips.TLSCiphersBackwardCompatible()
991+
tlsConfig.CipherSuites = crypto.TLSCiphersBackwardCompatible()
992992
}
993-
tlsConfig.CurvePreferences = fips.TLSCurveIDs()
993+
tlsConfig.CurvePreferences = crypto.TLSCurveIDs()
994994
return tlsConfig
995995
}
996996

0 commit comments

Comments
 (0)