Is NATS-server FIPS compliant

[JosephTharayil]

Hi Team,

Can i know if the nats-server is FIPS compliant, and what is the crypto library used?

Thanks,
Jo

[philpennock]

It is not FIPS compliant (assuming you mean the usual FIP 140-2 and 140-3). We use the Go native TLS stack. We have no current plans to support FIPS. Any company contributing to NATS is of course welcome to develop support and contribute it, but we'd view the contribution very carefully and it might not be merged.

There are enough problems with FIPS variants of the main TLS algorithms that we believe that FIPS support is detrimental to product security and dangerous to try to support. Such a deliberate weakening has knock-on consequences everywhere. So a contribution to provide a FIPS mode would need to address this concern. It's also been a while since I looked at this, so it's possible that our using a minimum version of TLS 1.2 means that a lot of the old problems are mitigated.

[ancientlore]

Has anyone tried GOEXPERIMENT=boringcrypto, which uses the FIPS validated boringcrypto to implement Go's crypto?

[derekcollison]

Yes we now have a FIPS compliant server using boring crypto for our government customers.

[jzhn]

Hi @derekcollison that's great news! Can you please provide more information about the FIPS compliant nats server? Do you plan to provide official build with boring crypto or customers have to build NATs on our own with GOEXPERIMENT=boringcrypto ?

An official guide like https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/security/ssl#fips-140-2 would help. Looks like this fits in the existing issue nats-io/nats.docs#475

Thanks.

[derekcollison]

Currently the FIPS server is a commercial offering.