feat: Add FIPS mode getter API #4450
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
goatgoose
force-pushed
the
fips-mode-getter
branch
from
1888c42 to
8d59ad1
Compare
goatgoose
force-pushed
the
fips-mode-getter
branch
from
8d59ad1 to
33b38be
Compare
lrstewart
reviewed
Mar 6, 2024
goatgoose
force-pushed
the
fips-mode-getter
branch
from
d3c88a7 to
b4aeab3
Compare
goatgoose
force-pushed
the
fips-mode-getter
branch
from
b4aeab3 to
ed06432
Compare
lrstewart
reviewed
Mar 12, 2024
goatgoose
force-pushed
the
fips-mode-getter
branch
2 times, most recently
from
5178581 to
1b3bcb8
Compare
maddeleine
approved these changes
Mar 14, 2024
lrstewart
approved these changes
Mar 14, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description of changes:
It's currently difficult to determine whether s2n-tls is operating in FIPS mode, which is essential for FIPS compliance. The best way to do this would be to query the linked libcrypto via
FIPS_mode(), and then infer that s2n-tls read this value and enabled FIPS mode ins2n_init().However, this method of validating the FIPS mode doesn't actually check the real s2n-tls FIPS mode. Additionally, this solution isn't possible when
S2N_INTERN_LIBCRYPTOis enabled, and the application doesn't have access to the linked libcrypto.This PR adds a new API to retrieve the s2n-tls FIPS mode to make it easier for applications to validate that their environment is compliant with FIPS.
Testing:
I added a new build test to ensure that FIPS mode is enabled when we think it should be. I tested that this test is working by swapping the FIPS mode checks and ensuring that the AWS-LC/AWS-LC-FIPS codebuild jobs failed as expected.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.