crypto/tls: require EMS issue with GOEXPERIMENT=boringcrypto

[afayasa]

Go version

v1.25.x and v1.26.0

Output of go env in your module/workspace:

CC='clang'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='clang++'
GCCGO='gccgo'
GO111MODULE='on'
GOARCH='arm64'
GOARM64='v8.0'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/Users/test-user/Library/Caches/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/Users/test-user/Library/Application Support/go/env'
GOEXE=''
GOEXPERIMENT='boringcrypto'
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -arch arm64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -ffile-prefix-map=/var/folders/9_/y59pzn2j1rb8crbgfysywb800000gn/T/go-build1547679347=/tmp/go-build -gno-record-gcc-switches -fno-common'
GOHOSTARCH='arm64'
GOHOSTOS='darwin'
GOINSECURE=''
GOMOD='/dev/null'
GOMODCACHE='/Users/test-user/workspace/pkg/mod'
GOOS='darwin'
GOPATH='/Users/test-user/workspace'
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/darwin_arm64'
GOVCS=''
GOVERSION='go1.26.0'
GOWORK=''
PKG_CONFIG='pkg-config'

What did you do?

Using Go v1.25, we built binaries with the GOEXPERIMENT=boringcrypto flag and attempted to connect to a server running only TLS 1.2 without EMS.

Sample code connecting to server running with TLS 1.2 without EMS

package main

import (
        "crypto/tls"
        "fmt"
        "log"
        "net/http"
        "time"
)

func main() {
        // server listening only on TLS 1.2 and without EMS
        url := "https://example.tls12only-server-without-ems/"


        // Force only TLS 1.2
        tlsConfig := &tls.Config{
                MinVersion: tls.VersionTLS12,
                MaxVersion: tls.VersionTLS12,
        }

        transport := &http.Transport{
                TLSClientConfig: tlsConfig,
        }

        client := &http.Client{
                Transport: transport,
                Timeout:   10 * time.Second,
        }

        resp, err := client.Get(url)
        if err != nil {
                log.Fatalf("Request failed: %v", err)
        }
        defer resp.Body.Close()

        fmt.Println("Response Status:", resp.Status)
        fmt.Println("Negotiated TLS Version:", tlsVersion(resp.TLS.Version))
        fmt.Println("Cipher Suite:", tls.CipherSuiteName(resp.TLS.CipherSuite))
}

func tlsVersion(v uint16) string {
        switch v {
        case tls.VersionTLS12:
                return "TLS 1.2"
        default:
                return "Unexpected version"
        }
}

Run with boringcrypto

GOEXPERIMENT=boringcrypto go run main.go

What did you see happen?

With Go v1.25 and v1.26, binaries built using the GOEXPERIMENT=boringcrypto flag fail with the following error when attempting to connect to servers running TLS 1.2 without EMS.

Get "https://x.x.x.x": tls: FIPS 140-3 requires the use of Extended Master Secret

What did you expect to see?

When using GOEXPERIMENT=boringcrypto, the EMS requirement check should not be triggered. Additionally, since Go with BoringCrypto is incompatible with the native FIPS 140-3 mode, we cannot use the GODEBUG=fips140 flag to disable the stricter FIPS 140-3 enforcement.

[gabyhelp]

Related Issues

• crypto/fips140: TLS handshake fails with go1.25 and FIPS-140-3 strict mode #75166 (closed)
• crypto/tls: TLS 1.2 connection fails to be established with `insufficient security level` after TLS 1.3 fixes #75336
• crypto/ecdh: Basic HTTPS request broken when FIPS-140 is enforced #76112 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[dr2chase]

@golang/security

[rolandshoemaker]

See https://go.dev/src/crypto/internal/boring/README, in particular: "Use of GOEXPERIMENT=boringcrypto outside Google is unsupported."

The BoringCrypto mode is intended to provide FIPS 140-3 support for Google. In this mode EMS is required. We don't make changes to this code to support other use cases.