cybercyst/go
1
0
Fork 0
mirror of https://github.com/golang/go.git synced 2025-05-08 00:53:07 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

crypto/cipher: block non-AES CTR and CBC in fips140=only mode

Browse Source 
Somehow I had missed these.

For #69536

Change-Id: I5e60b6f052bbfb707742ad15f663517c6c5f68d3
Reviewed-on: https://go-review.googlesource.com/c/go/+/636795
Auto-Submit: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Roland Shoemaker <roland@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: David Chase <drchase@google.com>
This commit is contained in:
Filippo Valsorda 2024-12-16 19:30:58 +01:00 committed by Gopher Robot
parent dd7a7ba38f
commit b47ce8b0e9
2 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/crypto/cipher/cbc.go
View File

@ -15,6 +15,7 @@ import (
"bytes" "bytes"
"crypto/internal/fips140/aes" "crypto/internal/fips140/aes"
"crypto/internal/fips140/alias" "crypto/internal/fips140/alias"
"crypto/internal/fips140only"
"crypto/subtle" "crypto/subtle"
) )
@ -53,6 +54,9 @@ func NewCBCEncrypter(b Block, iv []byte) BlockMode {
if b, ok := b.(*aes.Block); ok { if b, ok := b.(*aes.Block); ok {
return aes.NewCBCEncrypter(b, [16]byte(iv)) return aes.NewCBCEncrypter(b, [16]byte(iv))
} }
if fips140only.Enabled {
panic("crypto/cipher: use of CBC with non-AES ciphers is not allowed in FIPS 140-only mode")
}
if cbc, ok := b.(cbcEncAble); ok { if cbc, ok := b.(cbcEncAble); ok {
return cbc.NewCBCEncrypter(iv) return cbc.NewCBCEncrypter(iv)
} }
@ -129,6 +133,9 @@ func NewCBCDecrypter(b Block, iv []byte) BlockMode {
if b, ok := b.(*aes.Block); ok { if b, ok := b.(*aes.Block); ok {
return aes.NewCBCDecrypter(b, [16]byte(iv)) return aes.NewCBCDecrypter(b, [16]byte(iv))
} }
if fips140only.Enabled {
panic("crypto/cipher: use of CBC with non-AES ciphers is not allowed in FIPS 140-only mode")
}
if cbc, ok := b.(cbcDecAble); ok { if cbc, ok := b.(cbcDecAble); ok {
return cbc.NewCBCDecrypter(iv) return cbc.NewCBCDecrypter(iv)
} }

4
src/crypto/cipher/ctr.go
View File

@ -16,6 +16,7 @@ import (
"bytes" "bytes"
"crypto/internal/fips140/aes" "crypto/internal/fips140/aes"
"crypto/internal/fips140/alias" "crypto/internal/fips140/alias"
"crypto/internal/fips140only"
"crypto/subtle" "crypto/subtle"
) )
@ -41,6 +42,9 @@ func NewCTR(block Block, iv []byte) Stream {
if block, ok := block.(*aes.Block); ok { if block, ok := block.(*aes.Block); ok {
return aesCtrWrapper{aes.NewCTR(block, iv)} return aesCtrWrapper{aes.NewCTR(block, iv)}
} }
if fips140only.Enabled {
panic("crypto/cipher: use of CTR with non-AES ciphers is not allowed in FIPS 140-only mode")
}
if ctr, ok := block.(ctrAble); ok { if ctr, ok := block.(ctrAble); ok {
return ctr.NewCTR(iv) return ctr.NewCTR(iv)
} }