Golang: Crypto/fips140: do not bloat crypto code unnecessarily

1 comments

• $westurner a day ago

  Isn't there still need for non- or post- FIPS-140 -like cipher restrictions in non FIPS-140 environments?

  How much code is needed to implement Classical+PQ (Hybrid PQ) or PQ-only (Only PQ) cipher selection restrictions just?

  FWIU, with golang:

    # This allows X25519MLKEM768 (Hybrid PQ)
    GODEBUG=fips140=on
  
    # This prevents any PQ ciphers from being used:
    GODEBUG=fips140=only
  

  tlsref needs to be revised to specify PQ cipher lists.