In order to make a QUIC stack ready for FIPS 140, the AEADs used need to be constructed using standard library functions. See @FiloSottile's analysis in quic-go/quic-go#5077 (comment).
For that purpose, NewGCMForTLS13 and NewGCMForQUIC were added in https://go-review.googlesource.com/c/go/+/723760. The goal was to have these constructors live in the standard library so they could be validated as part of the Go Cryptographic Module and eventually exported.
While the implementation work was done, the functions were never exported. Today, the only way to construct an AEAD in a FIPS 140-compatible way is by using go:linkname and hooking into crypto/tls.aeadAESGCMTLS13. This is what quic-go will need to do (see quic-go/quic-go#5624) until the constructors are available (feel free to add us to the hall of shame).
Proposed change: Export NewGCMForTLS13 and NewGCMForQUIC from the crypto/tls package. It would be great if that could happen in time for the Go 1.27 release.
In order to make a QUIC stack ready for FIPS 140, the AEADs used need to be constructed using standard library functions. See @FiloSottile's analysis in quic-go/quic-go#5077 (comment).
For that purpose,
NewGCMForTLS13andNewGCMForQUICwere added in https://go-review.googlesource.com/c/go/+/723760. The goal was to have these constructors live in the standard library so they could be validated as part of the Go Cryptographic Module and eventually exported.While the implementation work was done, the functions were never exported. Today, the only way to construct an AEAD in a FIPS 140-compatible way is by using
go:linknameand hooking intocrypto/tls.aeadAESGCMTLS13. This is what quic-go will need to do (see quic-go/quic-go#5624) until the constructors are available (feel free to add us to the hall of shame).Proposed change: Export
NewGCMForTLS13andNewGCMForQUICfrom the crypto/tls package. It would be great if that could happen in time for the Go 1.27 release.