feat: gate DIGEST-MD5 and NTLM behind requirefips build tag - #619
Open
macdewee wants to merge 2 commits into
Open
feat: gate DIGEST-MD5 and NTLM behind requirefips build tag#619macdewee wants to merge 2 commits into
macdewee wants to merge 2 commits into
Conversation
DIGEST-MD5 (MD5/MD4) and NTLM (MD4, HMAC-MD5, RC4, DES) use algorithms that are not FIPS 140-2/3 approved and cannot be made compliant — the protocols are inherently non-FIPS by design. Under -tags requirefips, both mechanisms are replaced by stubs that return a clear error directing users to GSSAPIBind (Kerberos) or SimpleBind over TLS. This physically removes go-ntlmssp and the direct x/crypto/md4 and crypto/md5 imports from the binary, satisfying the strict FedRAMP High requirement that non-FIPS crypto must be absent from the binary, not merely unreachable at runtime. Non-FIPS builds are unchanged. A fips140.Enabled() runtime guard is also added as a defence-in-depth safety net for binaries built without the tag but running under GOFIPS140. Known limitation: gokrb5 pulls in x/crypto/md4 and crypto/rc4 for its RC4-HMAC Kerberos enctype support regardless of build tags. This will be addressed in a separate upstream or Elastic fork PR. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds two steps to the PR workflow: - build/vet/test with -tags requirefips to catch regressions in the FIPS stubs - dependency graph check that fails if any forbidden non-FIPS package (currently go-ntlmssp) appears in a requirefips build TODO in the dep check: extend the forbidden list to include x/crypto/md4 and x/crypto/rc4 once gokrb5 RC4-HMAC enctype support is gated behind a build tag. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Gates non-FIPS-compliant algorithms (MD4, MD5, RC4, DES — used by DIGEST-MD5 and NTLM) behind the requirefips build tag. When built with -tags requirefips, these mechanisms return an error and their dependencies (go-ntlmssp, x/crypto/md4, crypto/md5) are absent from the binary. No behavior change for normal builds — the code was moved, not rewritten.
Known limitation:
gokrb5still pulls inx/crypto/md4andcrypto/rc4via its RC4-HMAC Kerberos enctype support. To be addressed in a separate PR.