$ the-wire · showcase
FIPS 140 crypto fixes land across SHA-3, TLS 1.2, and HKDF
By RepoJournal · Filed · About Go · Composed from the cited sources · methodology
A day of correctness work inside crypto/internal/fips140, where the approval indicators Go records for its own primitives were wrong in three places.
crypto/internal/fips140/sha3: record legacy Keccak as non-approved golang/go
Legacy Keccak shares the Digest type with SHA-3, so Digest.Sum recorded it as approved, and HMAC plus RSA-PSS/OAEP accepted any *sha3.Digest and inherited the wrong indicator. The commit states NewLegacyKeccak256 and NewLegacyKeccak512 are not used outside tests, so no public API is affected.
crypto/internal/fips140/tls12: record SHA-384 as approved in MasterSecret golang/go
The extended master secret derivation with SHA-384 was recorded as non-approved because the code checked for a 46-byte output instead of 48. SHA-384 TLS 1.2 connections that should have counted as approved did not.
crypto/hkdf: remove unnecessary HMAC key length allowance for HKDF-Expand golang/go
Filippo Valsorda removed an unnecessary HMAC key length allowance in HKDF-Expand, tightening the check to what HKDF actually permits.
types2, go/types: return Invalid rather than nil golang/go
Checker.recordTypeAndValue now records invalid expressions in Info.Types and types2's syntax.Expr.TypeInfo, so Info.TypeOf returns Typ[Invalid] for undeclared identifiers and invalid selectors instead of nil. Tools that distinguished nil from Invalid on failed type checks will see the second.
crypto/internal/fips140/aes/gcm: add loong64 AES-GCM implementation golang/go
loong64 gets an AES-GCM assembly backend following the amd64 and arm64 structure, with a constant-time scalar GHASH port since LoongArch has no carry-less multiply instruction. The implementation is gated on the loong64 build constraint and a CPU feature check.
