FIPS 140-2 User Guide

July 7, 2026 ยท View on GitHub

This document is a user guide for the Microsoft build of Go crypto package running on FIPS 140-2 compatibility mode (hereafter referred to as FIPS). It is intended as a technical reference for developers using, and system administrators installing, the Go toolset, and for use in risk assessment reviews by security auditors. This is not a replacement for the Go crypto documentation, rather it is a collection of notes and more detailed explanations in the context of FIPS compatibility.

The Go crypto documentation is available online at https://pkg.go.dev/crypto.

The Microsoft build of Go crypto backends

The OpenSSL backend uses go-crypto-openssl. The CNG backend uses go-crypto-winnative. The CommonCrypto/CryptoKit backend uses go-crypto-darwin. For more general information about the backends, such as how to enable them, see the Microsoft build of Go FIPS README.

Note

The CNG backend uses a module called "bcrypt" to interact with CNG. Some identifiers and functions used by the CNG backend include a "bcrypt" prefix, referring to the "bcrypt" CNG module. For example, BCryptGenRandom is a function that generates random numbers using CNG.

There is also a password hashing algorithm called "bcrypt". It is unrelated, and not in the scope of this document.

Using Go crypto APIs

This section describes how to use Go crypto APIs in a FIPS compliant manner.

As a general rule, crypto APIs will delegate low-level operations to the crypto backend if these rules are met:

  • The operation is supported by the crypto backend.
  • The set of input parameters are supported by the crypto backend.

If any of the previous rules are not met, the operation will fall back to standard Go crypto unless otherwise specified. Standard Go crypto will behave as expected but is not FIPS compliant. There is not yet any way to configure the crypto APIs to panic instead of falling back to standard Go crypto. See microsoft/go#428.

When reading the requirements section, the key word "must" is to be interpreted as a necessary condition to use the given API in a FIPS compliant manner.

crypto/aes

Package aes implements AES encryption (formerly Rijndael), as defined in U.S. Federal Information Processing Standards Publication 197.

func NewCipher

func aes.NewCipher(key []byte) (cipher cipher.Block, err error)

NewCipher creates and returns a new cipher.Block.

Requirements

  • key length must be 16, 24, or 32 bytes.

Implementation

OpenSSL (click for details)

cipher implements the cipher.Block interface using a cipher function that depends on the key length:

The cipher.Block methods are implemented as follows:

CNG (click for details)

cipher implements the cipher.Block interface using the algorithm identifier BCRYPT_AES_ALGORITHM with BCRYPT_CHAIN_MODE_ECB mode, generated using BCryptGenerateSymmetricKey.

The cipher.Block methods are implemented as follows:

crypto/cipher

Package cipher implements standard block cipher modes that can be wrapped around low-level block cipher implementations.

func NewGCM

func cipher.NewGCM(cipher cipher.Block) (aead cipher.AEAD, err error)

NewGCM returns the given 128-bit, block cipher wrapped in Galois Counter Mode with the standard nonce length.

Requirements

Implementation

OpenSSL (click for details)

cipher implements the cipher.AEAD interface using a cipher function that depends on the key length of cipher:

CNG (click for details)

cipher implements the cipher.Block interface using the algorithm identifier BCRYPT_AES_ALGORITHM with BCRYPT_CHAIN_MODE_GCM mode, generated using BCryptGenerateSymmetricKey.

The cipher.Block methods are implemented as follows:

func NewGCMWithNonceSize

func cipher.NewGCMWithNonceSize(cipher cipher.Block, size int) (aead cipher.AEAD, error)

NewGCMWithNonceSize returns the given 128-bit, block cipher wrapped in Galois Counter Mode, which accepts nonces of the given length.

Requirements

  • cipher must be an object created by aes.NewCipher.
  • size must be 12.

Implementation

aead can have different implementations depending on the supplied parameters:

  • If the parameters meet the requirements, then aead behaves exactly as if it was created with aes.NewCipher.
  • If cipher is an object created by aes.NewCipher and size != 12, then aead is implemented by the standard Go library and the crypto backend is only used for encryption and decryption.
  • Else aead is completely implemented by the standard Go library.

func NewGCMWithTagSize

func cipher.NewGCMWithTagSize(cipher cipher.Block, tagSize int) (aead cipher.AEAD, error)

NewGCMWithTagSize returns the given 128-bit, block cipher wrapped in Galois Counter Mode, which generates tags with the given length.

Requirements

  • cipher must be an object created by aes.NewCipher.
  • tagSize must be 16.

Implementation

aead can have different implementations depending on the supplied parameters:

  • If the parameters meet the requirements, then aead behaves exactly as if it was created with aes.NewCipher.
  • If cipher is an object created by aes.NewCipher and tagSize != 16 then aead is implemented by the standard Go library using the crypto backend for encryption and decryption.
  • Else aead is completely implemented by the standard Go library.

func NewCBCDecrypter

func cipher.NewCBCDecrypter(block Block, iv []byte) (cbc cipher.BlockMode)

NewCBCDecrypter returns a BlockMode which decrypts in cipher block chaining mode, using the given Block.

Requirements

Implementation

OpenSSL (click for details)

cbc implements the cipher.BlockMode interface using a cipher that depends on the block key length:

In all cases the cipher will have the padding disabled using EVP_CIPHER_CTX_set_padding.

The cipher.BlockMode methods are implemented as follows:

  • BlockSize always returns the underlying cipher block size.
  • CryptBlocks uses EVP_DecryptUpdate.
CNG (click for details)

cipher implements the cipher.Block interface using the underlying cipher algorithm identifier with BCRYPT_CHAIN_MODE_CBC mode, generated using BCryptGenerateSymmetricKey.

The cipher.Block methods are implemented as follows:

  • BlockSize always returns the underlying cipher block size.
  • CryptBlocks uses BCryptDecrypt.

func NewCBCEncrypter

func cipher.NewCBCEncrypter(block Block, iv []byte) (cbc cipher.BlockMode)

NewCBCEncrypter returns a BlockMode which encrypts in cipher block chaining mode, using the given Block.

Requirements

Implementation

OpenSSL (click for details)

cbc implements the cipher.BlockMode interface using a cipher that depends on the block key length:

The cipher.BlockMode methods are implemented as follows:

  • BlockSize always returns the underlying cipher block size.
  • CryptBlocks uses EVP_EncryptUpdate.
CNG (click for details)

cipher implements the cipher.Block interface using the underlying cipher algorithm identifier with BCRYPT_CHAIN_MODE_CBC mode, generated using BCryptGenerateSymmetricKey.

The cipher.Block methods are implemented as follows:

  • BlockSize always returns the underlying cipher block size.
  • CryptBlocks uses BCryptEncrypt.

func NewCFBDecrypter

cipher.NewCFBDecrypter is not implemented by any backend.

func NewCFBEncrypter

cipher.NewCFBEncrypter is not implemented by any backend.

func NewCTR

func cipher.NewCTR(block Block, iv []byte) (ctr cipher.Stream)

NewCTR returns a Stream which encrypts/decrypts using the given Block in counter mode.

Requirements

  • The CNG backend does not implement this function.
  • block must be an object created by aes.NewCipher.

Implementation

OpenSSL (click for details)

ctr implements the cipher.Stream interface using a cipher that depends on the block key length:

The cipher.Stream methods are implemented as follows:

  • XORKeyStream(dst, src []byte) XORs each byte in the given slice using EVP_EncryptUpdate.

func NewOFB

cipher.NewOFB is not implemented by any backend.

func StreamReader.Read

func (r cipher.StreamReader) Read(dst []byte) (n int, err error)

Requirements

  • The CNG backend does not implement this function.
  • r.S must be an object created by cipher.NewCTR.

func StreamWriter.Write

func (w cipher.StreamWriter) Write(src []byte) (n int, err error)

Requirements

  • The CNG backend does not implement this function.
  • r.S must be an object created by cipher.NewCTR.

func StreamWriter.Close

func (w cipher.StreamWriter) Close() error

Does not contain crypto algorithms, out of FIPS scope.

crypto/des

Package des implements the Data Encryption Standard (DES) and the Triple Data Encryption Algorithm (TDEA) as defined in U.S. Federal Information Processing Standards Publication 46-3.

DES is cryptographically broken and should not be used for secure applications.

func NewCipher

func des.NewCipher(key []byte) (cipher.Block, error)

NewCipher creates and returns a new cipher.Block.

Requirements

  • key length must be 8 bytes.
  • OpenSSL does not provide a DES implementation in FIPS mode. In that case, the code will fall back to standard Go crypto.

Implementation

OpenSSL (click for details)

cipher implements the cipher.Block interface using the [EVP_des_128_ecb] cipher function.

The cipher.Block methods are implemented as follows:

CNG (click for details)

cipher implements the cipher.Block interface using the algorithm identifier BCRYPT_DES_ALGORITHM with BCRYPT_CHAIN_MODE_ECB mode, generated using BCryptGenerateSymmetricKey.

The cipher.Block methods are implemented as follows:

func NewTripleDESCipher

NewTripleDESCipher(key []byte) (cipher.Block, error)

NewTripleDESCipher creates and returns a new cipher.Block.

Requirements

  • key length must be 24 bytes.

Implementation

OpenSSL (click for details)

cipher implements the cipher.Block interface using the EVP_des_ede3_ecb cipher function.

The cipher.Block methods are implemented as follows:

CNG (click for details)

cipher implements the cipher.Block interface using the algorithm identifier BCRYPT_DES3_ALGORITHM with BCRYPT_CHAIN_MODE_ECB mode, generated using BCryptGenerateSymmetricKey.

The cipher.Block methods are implemented as follows:

crypto/dsa

Not implemented by any backend.

crypto/ecdh

Package ecdh implements Elliptic Curve Diffie-Hellman over NIST curves and Curve25519.

Implementation

All supported curves implement the ecdh.Curve interface as follows:

OpenSSL (click for details)
CNG (click for details)

func P256

func ecdh.P256() ecdh.Curve

P256 returns a Curve which implements NIST P-256.

Implementation

OpenSSL (click for details)

The curve uses NID_X9_62_prime256v1.

CNG (click for details)

The curve uses BCRYPT_ECC_CURVE_NISTP256.

func P384

func ecdh.P384() ecdh.Curve

P384 returns a Curve which implements NIST P-384.

Implementation

OpenSSL (click for details)

The curve uses NID_secp384r1.

CNG (click for details)

The curve uses BCRYPT_ECC_CURVE_NISTP384.

func P521

func ecdh.P521() ecdh.Curve

P521 returns a Curve which implements NIST P-521.

Implementation

OpenSSL (click for details)

The curve uses NID_secp521r1.

CNG (click for details)

The curve uses BCRYPT_ECC_CURVE_NISTP521.

func X25519

ecdh.X25519 is not implemented by any backend.

func PrivateKey.ECDH

func (k *ecdh.PrivateKey) ECDH(remote *ecdh.PublicKey) ([]byte, error)

ECDH performs an ECDH exchange and returns the shared secret. The PrivateKey and PublicKey must use the same curve.

Requirements

  • remote must be an object created from ecdh.P256(), ecdh.P384(), or ecdh.P521().

Implementation

OpenSSL (click for details)

The key is derived using EVP_PKEY_derive.

CNG (click for details)

The key is derived using BCryptDeriveKey.

crypto/ecdsa

Package ecdsa implements the Elliptic Curve Digital Signature Algorithm, as defined in FIPS 186-3.

func Sign

func ecdsa.Sign(rand io.Reader, priv *ecdsa.PrivateKey, hash []byte) (r, s *big.Int, err error)

Sign signs a hash using the private key.

Requirements

  • rand must be boring.RandReader, else Sign will panic. crypto/rand.Reader normally meets this invariant, as it is assigned to boring.RandReader in the crypto/rand init function.
  • hash must be the result of hashing a message using a FIPS compliant hashing algorithm.

Implementation

OpenSSL (click for details)

r and s are generated using EVP_PKEY_sign.

CNG (click for details)

r and s are generated using BCryptSignHash.

func SignASN1

func ecdsa.SignASN1(rand io.Reader, priv *ecdsa.PrivateKey, hash []byte) (sig []byte, err error)

SignASN1 signs a hash using the private key. It behaves as ecdsa.Sign but returns an ASN.1 encoded signature instead.

func Verify

func ecdsa.Verify(pub *ecdsa.PublicKey, hash []byte, r, s *big.Int) bool

Verify verifies the signature in r, s of hash using the public key.

Requirements

There are no specific parameters requirements in order to be FIPS compliant.

Implementation

OpenSSL (click for details)

The signature is verified using EVP_PKEY_verify.

CNG (click for details)

The signature is verified using BCryptVerifySignature.

func VerifyASN1

func ecdsa.VerifyASN1(pub *ecdsa.PublicKey, hash, sig []byte) bool

VerifyASN1 verifies the ASN.1 encoded signature, sig, of hash using the public key. It behaves as ecdsa.Verify but accepts an ASN.1 encoded signature instead.

func GenerateKey

func ecdsa.GenerateKey(c elliptic.Curve, rand io.Reader) (priv *ecdsa.PrivateKey, err error)

GenerateKey generates a public and private key pair.

Requirements

  • c.Params().Name must be one of the following values: P-224, P-256, P-384, or P-521.
  • The CNG backend does not support P-224.
  • rand must be boring.RandReader, else GenerateKey will panic. crypto/rand.Reader normally meets this invariant as it is assigned to boring.RandReader in the crypto/rand init function.

Implementation

OpenSSL (click for details)

priv is a wrapper around an EVP_PKEY generated using EVP_PKEY_keygen.

priv curve algorithm depends on the value of c:

  • If c.Params().Name == "P-224" then curve is NID_secp224r1.
  • If c.Params().Name == "P-256" then curve is NID_X9_62_prime256v1.
  • If c.Params().Name == "P-384" then curve is NID_secp384r1.
  • If c.Params().Name == "P-521" then curve is NID_secp521r1.
CNG (click for details)

priv is generated using BCryptGenerateKeyPair.

priv algorithm identifier is BCRYPT_ECDSA_ALGORITHM and the named elliptic curve depends on the value of c:

  • If c.Params().Name == "P-224" then curve is BCRYPT_ECC_CURVE_NISTP224.
  • If c.Params().Name == "P-256" then curve is BCRYPT_ECC_CURVE_NISTP256.
  • If c.Params().Name == "P-384" then curve is BCRYPT_ECC_CURVE_NISTP384.
  • If c.Params().Name == "P-521" then curve is BCRYPT_ECC_CURVE_NISTP521.

func PrivateKey.Sign

func (priv *ecdsa.PrivateKey) Sign(rand io.Reader, digest []byte, opts crypto.SignerOpts) ([]byte, error)

Sign signs digest with priv.

Requirements

  • rand must be boring.RandReader, else Sign will panic. crypto/rand.Reader normally meets this invariant as it is assigned to boring.RandReader in the crypto/rand init function.
  • digest must be the result of hashing a message using a FIPS compliant hashing algorithm.

Implementation

OpenSSL (click for details)

The message is signed using EVP_PKEY_sign.

CNG (click for details)

The message is signed using BCryptSignHash.

crypto/ed25519

Package ed25519 implements the Ed25519 signature algorithm. See https://ed25519.cr.yp.to/.

Requirements

The CNG backend and some old OpenSSL distributions don't support ED25519. In those cases, the code will fall back to standard Go crypto.

func GenerateKey

func GenerateKey(rand io.Reader) (pub ed25519.PublicKey, priv ed25519.PrivateKey, error)

GenerateKey generates a public/private key pair using entropy from rand. If rand is nil, crypto/rand.Reader will be used.

Requirements

  • rand must be boring.RandReader or nil. crypto/rand.Reader normally meets this invariant as it is assigned to boring.RandReader in the crypto/rand init function.

Implementation

OpenSSL (click for details)

pub and priv are generated using EVP_PKEY_keygen with the EVP_PKEY_ED25519 algorithm.

func Sign

func Sign(privateKey ed25519.PrivateKey, message []byte) []byte

Sign signs the message with privateKey and returns a signature. It will panic if len(privateKey) is not PrivateKeySize.

Implementation

OpenSSL (click for details)

message is signed using EVP_MD_CTX_new, EVP_DigestSignInit and EVP_DigestSign.

func Verify

func Verify(publicKey ed25519.PublicKey, message, sig []byte) bool

Verify reports whether sig is a valid signature of message by publicKey. It will panic if len(publicKey) is not PublicKeySize.

Requirements

  • OpenSSL version must be 1.1.1b or higher. Otherwise, falls back to standard Go crypto.

Implementation

OpenSSL (click for details)

message is verified against sig using EVP_MD_CTX_new, EVP_DigestVerifyInit and EVP_DigestVerify.

func VerifyWithOptions

func VerifyWithOptions(publicKey PublicKey, message, sig []byte, opts *Options) error

VerifyWithOptions reports whether sig is a valid signature of message by publicKey. A valid signature is indicated by returning a nil error. It will panic if len(publicKey) is not PublicKeySize.

Requirements

  • Only opts.Hash == nil && opts.Context == "" is implemented using the OpenSSL backend. Other combinations fall back to standard Go code.

Implementation

OpenSSL (click for details)

message is verified against sig using EVP_MD_CTX_new, EVP_DigestVerifyInit and EVP_DigestVerify.

func NewKeyFromSeed

func NewKeyFromSeed(seed []byte) (priv ed25519.PrivateKey)

NewKeyFromSeed calculates a private key from a seed. It will panic if len(seed) is not SeedSize.

Implementation

OpenSSL (click for details)

priv is generated using EVP_PKEY_new_raw_private_key with the EVP_PKEY_ED25519 algorithm.

func PrivateKey.Sign

func (priv ed25519.PrivateKey) Sign(rand io.Reader, message []byte, opts crypto.SignerOpts) (signature []byte, err error)

Sign signs the given message with priv. rand is ignored and can be nil.

Requirements

  • Only opts.Hash == nil && opts.Context == "" is implemented using the OpenSSL backend. Other combinations fall back to standard Go code.

Implementation

OpenSSL (click for details)

message is signed using EVP_MD_CTX_new, EVP_DigestSignInit and EVP_DigestSign.

crypto/elliptic

Not implemented by any backend, but to use ecdsa.GenerateKey, one of the following elliptic.Curve constructors must be used to specify the curve. See ecdsa.GenerateKey for additional requirements. As long as the requirements are met, only the name of the curve is used, not the curve parameters or methods implemented by standard Go crypto, allowing FIPS compliance.

func elliptic.P224() elliptic.Curve
func elliptic.P256() elliptic.Curve
func elliptic.P384() elliptic.Curve
func elliptic.P521() elliptic.Curve

crypto/hkdf

Package hkdf implements the HMAC-based Extract-and-Expand Key Derivation Function (HKDF) as defined in RFC 5869.

The hash function passed to the HKDF APIs must be one supported by the crypto backend (see crypto/sha1, crypto/sha256, crypto/sha512, and crypto/sha3). If the hash is not supported by the backend, the operation falls back to standard Go crypto.

func Extract

func hkdf.Extract[H hash.Hash](h func() H, secret, salt []byte) ([]byte, error)

Extract generates a pseudorandom key for use with hkdf.Expand from the input secret and an optional salt.

Requirements

  • h must return a hash supported by the crypto backend.

Implementation

OpenSSL (click for details)

The pseudorandom key is derived using the HKDF KDF in extract-only mode. On OpenSSL 1.x this uses EVP_PKEY_derive with an EVP_PKEY_HKDF context configured with EVP_PKEY_HKDF_MODE_EXTRACT_ONLY. On OpenSSL 3.x this uses EVP_KDF_derive with the HKDF KDF set to extract-only mode.

CNG (click for details)

The pseudorandom key is derived using BCryptKeyDerivation with the BCRYPT_HKDF_ALGORITHM algorithm identifier, setting the hash with the BCRYPT_HKDF_HASH_ALGORITHM property and finalizing with the BCRYPT_HKDF_SALT_AND_FINALIZE property.

func Expand

func hkdf.Expand[H hash.Hash](h func() H, pseudorandomKey []byte, info string, keyLength int) ([]byte, error)

Expand derives a key of keyLength bytes from the given pseudorandomKey and optional info, returned by hkdf.Extract.

Requirements

  • h must return a hash supported by the crypto backend.

Implementation

OpenSSL (click for details)

The key is derived using the HKDF KDF in expand-only mode. On OpenSSL 1.x this uses EVP_PKEY_derive with an EVP_PKEY_HKDF context configured with EVP_PKEY_HKDF_MODE_EXPAND_ONLY. On OpenSSL 3.x this uses EVP_KDF_derive with the HKDF KDF set to expand-only mode.

CNG (click for details)

The key is derived using BCryptKeyDerivation with the BCRYPT_HKDF_ALGORITHM algorithm identifier, setting the pseudorandom key with the BCRYPT_HKDF_PRK_AND_FINALIZE property and the info with the BCRYPT_HKDF_INFO parameter.

func Key

func hkdf.Key[H hash.Hash](h func() H, secret, salt []byte, info string, keyLength int) ([]byte, error)

Key derives a key of keyLength bytes from the given secret, salt, and info. It is a convenience function that internally calls hkdf.Extract followed by hkdf.Expand, and is subject to the same requirements.

crypto/hmac

Package hmac implements the Keyed-Hash Message Authentication Code (HMAC) as defined in U.S. Federal Information Processing Standards Publication 198.

func Equal

func hmac.Equal(mac1, mac2 []byte) bool

Equal compares two MACs for equality without leaking timing information.

This function does not implement any cryptographic algorithm, therefore out of FIPS scope.

func New

func hmac.New(h func() hash.Hash, key []byte) hash.Hash

New returns a new HMAC hash using the given hash.Hash type and key.

Requirements

  • h must be one of the following functions: sha1.New, sha224.New, sha256.New, sha384.New, or sha512.New.
  • The CNG backend does not support sha224.New.

Implementation

OpenSSL 1.x (click for details)

The hmac is generated using HMAC_CTX_new and HMAC_Init_ex.

The hash.Hash methods are implemented as follows:

OpenSSL 3.x (click for details)

The hmac is generated using EVP_MAC_CTX_new and EVP_MAC_init.

The hash.Hash methods are implemented as follows:

CNG (click for details)

The hmac is generated using BCryptCreateHash with the BCRYPT_ALG_HANDLE_HMAC_FLAG flag.

The algorithm identifier depends on the value of h:

  • If h == sha1.New then algorithm is BCRYPT_SHA1_ALGORITHM.
  • If h == sha256.New then algorithm is BCRYPT_SHA256_ALGORITHM.
  • If h == sha384.New then algorithm is BCRYPT_SHA384_ALGORITHM.
  • If h == sha512.New then algorithm is BCRYPT_SHA512_ALGORITHM.

The hash.Hash methods are implemented as follows:

crypto/md5

Package md5 implements the MD5 hash algorithm as defined in RFC 1321.

MD5 is cryptographically broken and should not be used for secure applications.

func New

func md5.New() hash.Hash

New returns a new hash.Hash computing the MD5 checksum.

Implementation

OpenSSL (click for details)

The hash is generated using EVP_MD_CTX_new and EVP_DigestInit_ex with the algorithm EVP_md5.

The hash.Hash methods are implemented as follows:

CNG (click for details)

The hash is generated using BCryptCreateHash with the algorithm identifier BCRYPT_MD5_ALGORITHM.

The hash.Hash methods are implemented as follows:

func Sum

func md5.Sum(data []byte) [15]byte

Sum returns the MD5 checksum of the data. It internally uses md5.New() to compute the checksum.

crypto/mldsa

Package mldsa implements the post-quantum ML-DSA signature scheme as defined in FIPS 204.

The parameter set is selected with one of mldsa.MLDSA44(), mldsa.MLDSA65(), or mldsa.MLDSA87().

func GenerateKey

func mldsa.GenerateKey(params mldsa.Parameters) (*mldsa.PrivateKey, error)

GenerateKey generates a new random ML-DSA private key for the given parameter set.

Implementation

OpenSSL (click for details)

priv is a wrapper around an EVP_PKEY generated using EVP_PKEY_keygen with the ML-DSA-44, ML-DSA-65, or ML-DSA-87 key type.

CNG (click for details)

priv is generated using BCryptGenerateKeyPair with the BCRYPT_MLDSA_ALGORITHM algorithm identifier and the parameter set name (44, 65, or 87) set via the BCRYPT_PARAMETER_SET_NAME property.

func NewPrivateKey

func mldsa.NewPrivateKey(params mldsa.Parameters, seed []byte) (*mldsa.PrivateKey, error)

NewPrivateKey decodes an ML-DSA private key from the given seed, which must be exactly mldsa.PrivateKeySize bytes long. The key is reconstructed from the seed using the same backend primitives as mldsa.GenerateKey.

func NewPublicKey

func mldsa.NewPublicKey(params mldsa.Parameters, encoding []byte) (*mldsa.PublicKey, error)

NewPublicKey decodes an ML-DSA public key from the given encoding, whose length must match params.PublicKeySize().

func PrivateKey.Sign

func (sk *mldsa.PrivateKey) Sign(_ io.Reader, message []byte, opts crypto.SignerOpts) (signature []byte, err error)

Sign returns a signature of message using sk. The io.Reader argument is ignored.

Requirements

  • If opts is nil or opts.HashFunc() returns zero, message is signed directly.
  • If opts.HashFunc() returns crypto.MLDSAMu, message must be a pre-hashed ฮผ message representative (external-mu, as defined in RFC 9881).
  • An optional context string can be supplied through *mldsa.Options.

Implementation

OpenSSL (click for details)

The message is signed using EVP_PKEY_sign.

CNG (click for details)

The message is signed using BCryptSignHash.

func PrivateKey.SignDeterministic

func (sk *mldsa.PrivateKey) SignDeterministic(message []byte, opts crypto.SignerOpts) (signature []byte, err error)

SignDeterministic behaves as mldsa.PrivateKey.Sign but produces a deterministic signature. It is subject to the same requirements.

func Verify

func mldsa.Verify(pk *mldsa.PublicKey, message []byte, signature []byte, opts *mldsa.Options) error

Verify reports whether signature is a valid signature of message by pk. A valid signature is indicated by returning a nil error.

Implementation

OpenSSL (click for details)

The signature is verified using EVP_PKEY_verify.

CNG (click for details)

The signature is verified using BCryptVerifySignature.

crypto/mlkem

Package mlkem implements the post-quantum ML-KEM key encapsulation method as defined in FIPS 203.

ML-KEM-768 and ML-KEM-1024 are supported by all backends.

func GenerateKey768

func mlkem.GenerateKey768() (*mlkem.DecapsulationKey768, error)

GenerateKey768 generates a new ML-KEM-768 decapsulation key. The corresponding encapsulation key is obtained with the EncapsulationKey method.

Implementation

OpenSSL (click for details)

The key is a wrapper around an EVP_PKEY generated using EVP_PKEY_keygen with the ML-KEM-768 key type.

CNG (click for details)

The key is generated using BCryptGenerateKeyPair with the BCRYPT_MLKEM_ALGORITHM algorithm identifier and the 768 parameter set name set via the BCRYPT_PARAMETER_SET_NAME property.

func GenerateKey1024

func mlkem.GenerateKey1024() (*mlkem.DecapsulationKey1024, error)

GenerateKey1024 generates a new ML-KEM-1024 decapsulation key. It behaves as mlkem.GenerateKey768 but uses the ML-KEM-1024 key type (OpenSSL) or the 1024 parameter set name (CNG).

Decapsulation keys can also be reconstructed from a seed using mlkem.NewDecapsulationKey768 and mlkem.NewDecapsulationKey1024, and encapsulation keys can be decoded with mlkem.NewEncapsulationKey768 and mlkem.NewEncapsulationKey1024.

func EncapsulationKey768.Encapsulate

func (ek *mlkem.EncapsulationKey768) Encapsulate() (sharedKey, ciphertext []byte)

Encapsulate generates a shared key and an associated ciphertext from the encapsulation key. The same shared key is recovered by the holder of the decapsulation key via mlkem.DecapsulationKey768.Decapsulate. The shared key must be kept secret.

Implementation

OpenSSL (click for details)

The shared key and ciphertext are generated using EVP_PKEY_encapsulate.

CNG (click for details)

The shared key and ciphertext are generated using the CNG ML-KEM encapsulation operation.

func DecapsulationKey768.Decapsulate

func (dk *mlkem.DecapsulationKey768) Decapsulate(ciphertext []byte) (sharedKey []byte, err error)

Decapsulate recovers the shared key from ciphertext using the decapsulation key. The ML-KEM-1024 keys expose analogous Encapsulate and Decapsulate methods.

Implementation

OpenSSL (click for details)

The shared key is recovered using EVP_PKEY_decapsulate.

CNG (click for details)

The shared key is recovered using the CNG ML-KEM decapsulation operation.

crypto/pbkdf2

Package pbkdf2 implements the key derivation function PBKDF2 as defined in RFC 8018 (PKCS #5 v2.1).

func Key

func pbkdf2.Key[H hash.Hash](h func() H, password string, salt []byte, iter, keyLength int) ([]byte, error)

Key derives a key of keyLength bytes from password and salt by applying the pseudorandom function iter times.

Requirements

  • h must return a hash supported by the crypto backend.

Implementation

OpenSSL (click for details)

On OpenSSL 1.x the key is derived using PKCS5_PBKDF2_HMAC. On OpenSSL 3.x the key is derived using EVP_KDF_derive with the PBKDF2 KDF.

CNG (click for details)

The key is derived using BCryptKeyDerivation with the BCRYPT_PBKDF2_ALGORITHM algorithm identifier, setting the iteration count, hash algorithm, and salt through key derivation parameters.

crypto/rand

Package rand implements a cryptographically secure random number generator.

var Reader

var Reader io.Reader

Reader is a global, shared instance of a cryptographically secure random number generator.

It is assigned to boring.RandReader in the crypto/rand init function.

Implementation

OpenSSL (click for details)

rand.Reader implements io.Reader using RAND_bytes

CNG (click for details)

rand.Reader implements io.Reader using BCryptGenRandom

func Int

func rand.Int(rand io.Reader, max *big.Int) (n *big.Int, err error)

Int returns a uniform random value in [0, max). It panics if max <= 0.

Requirements

  • rand must be boring.RandReader. crypto/rand.Reader normally meets this invariant as it is assigned to boring.RandReader in the crypto/rand init function.

func Prime

func Prime(rand io.Reader, bits int) (p *big.Int, err error)

Prime returns a number of the given bit length that is prime with high probability.

Requirements

  • rand must be boring.RandReader. crypto/rand.Reader normally meets this invariant as it is assigned to boring.RandReader in the crypto/rand init function.

func Read

func Read(b []byte) (n int, err error)

Read is a helper function that calls rand.Reader.Read using io.ReadFull.

Requirements

  • rand.Reader must be boring.RandReader. This invariant is normally met as rand.Reader is assigned to boring.RandReader in the crypto/rand init function.

crypto/rc4

Package rc4 implements RC4 encryption, as defined in Bruce Schneier's Applied Cryptography.

func NewCipher

func rc4.NewCipher() rc4.Cipher

NewCipher creates and returns a new Cipher. The key argument should be the RC4 key, at least 1 byte and at most 256 bytes.

Requirements

Some OpenSSL distributions don't implement RC4, e.g., OpenSSL 1.x compiled with -DOPENSSL_NO_RC4 and OpenSSL 3.x that can't load the legacy provider. In those cases, rc4.NewCipher() will fall back to standard Go crypto.

Implementation

OpenSSL (click for details)

The cipher is generated using EVP_CIPHER_CTX_new and EVP_CipherInit_ex with the cipher type EVP_rc4.

The rc4.Cipher methods are implemented as follows:

CNG (click for details)

The cipher is generated using BCryptGenerateSymmetricKey using the BCRYPT_RC4_ALGORITHM mode.

The rc4.Cipher methods are implemented as follows:

crypto/sha1

Package sha1 implements the SHA-1 hash algorithm as defined in RFC 3174.

SHA-1 is an approved FIPS 140-2 hash algorithm although it is cryptographically broken and should not be used for secure applications.

func New

func sha1.New() hash.Hash

New returns a new hash.Hash computing the SHA1 checksum.

Implementation

OpenSSL (click for details)

The hash is generated using EVP_MD_CTX_new and EVP_DigestInit_ex with the algorithm EVP_sha1.

The hash.Hash methods are implemented as follows:

CNG (click for details)

The hash is generated using BCryptCreateHash with the algorithm identifier BCRYPT_SHA1_ALGORITHM.

The hash.Hash methods are implemented as follows:

func Sum

func sha1.Sum(data []byte) [20]byte

Sum returns the SHA-1 checksum of the data. It internally uses sha1.New() to compute the checksum.

crypto/sha256

Package sha256 implements the SHA224 and SHA256 hash algorithms as defined in FIPS 180-4.

func New

func sha256.New() hash.Hash

New returns a new hash.Hash computing the SHA256 checksum.

Implementation

OpenSSL (click for details)

The hash is generated using EVP_MD_CTX_new and EVP_DigestInit_ex with the algorithm EVP_sha256.

The hash.Hash methods are implemented as follows:

CNG (click for details)

The hash is generated using BCryptCreateHash with the algorithm identifier BCRYPT_SHA256_ALGORITHM.

The hash.Hash methods are implemented as follows:

func New224

func sha256.New224() hash.Hash

New224 returns a new hash.Hash computing the SHA224 checksum.

Requirements

  • The CNG backend does not implement this function.

Implementation

OpenSSL (click for details)

The hash is generated using EVP_MD_CTX_new and EVP_DigestInit_ex with the algorithm EVP_sha224.

The hash.Hash methods are implemented as follows:

func Sum224

func sha256.Sum224(data []byte) [24]byte

Sum224 returns the SHA224 checksum of the data. It internally uses sha224.New() to compute the checksum.

Requirements

  • The CNG backend does not implement this function.

func Sum256

func sha256.Sum256(data []byte) [32]byte

Sum256 returns the SHA256 checksum of the data. It internally uses sha256.New() to compute the checksum.

crypto/sha3

Package sha3 implements the SHA-3 hash functions and the SHAKE and cSHAKE extendable-output functions (XOFs) as defined in FIPS 202.

The sha3.Sum224, sha3.Sum256, sha3.Sum384, and sha3.Sum512 one-shot helpers internally use the corresponding New* constructor, and sha3.SumSHAKE128 and sha3.SumSHAKE256 internally use the corresponding SHAKE constructor.

func New224

func sha3.New224() *sha3.SHA3

New224 returns a new hash.Hash computing the SHA3-224 checksum.

Requirements

  • The CNG backend does not implement this function.

Implementation

OpenSSL (click for details)

The hash is generated using EVP_MD_CTX_new and EVP_DigestInit_ex with the algorithm EVP_sha3_224.

The hash.Hash methods are implemented as follows:

func New256

func sha3.New256() *sha3.SHA3

New256 returns a new hash.Hash computing the SHA3-256 checksum.

Implementation

OpenSSL (click for details)

The hash is generated using EVP_MD_CTX_new and EVP_DigestInit_ex with the algorithm EVP_sha3_256.

The hash.Hash methods are implemented as follows:

CNG (click for details)

The hash is generated using BCryptCreateHash with the algorithm identifier BCRYPT_SHA3_256_ALGORITHM.

The hash.Hash methods are implemented as follows:

func New384

func sha3.New384() *sha3.SHA3

New384 returns a new hash.Hash computing the SHA3-384 checksum.

Implementation

OpenSSL (click for details)

The hash is generated using EVP_MD_CTX_new and EVP_DigestInit_ex with the algorithm EVP_sha3_384.

The hash.Hash methods are implemented as follows:

CNG (click for details)

The hash is generated using BCryptCreateHash with the algorithm identifier BCRYPT_SHA3_384_ALGORITHM.

The hash.Hash methods are implemented as follows:

func New512

func sha3.New512() *sha3.SHA3

New512 returns a new hash.Hash computing the SHA3-512 checksum.

Implementation

OpenSSL (click for details)

The hash is generated using EVP_MD_CTX_new and EVP_DigestInit_ex with the algorithm EVP_sha3_512.

The hash.Hash methods are implemented as follows:

CNG (click for details)

The hash is generated using BCryptCreateHash with the algorithm identifier BCRYPT_SHA3_512_ALGORITHM.

The hash.Hash methods are implemented as follows:

func NewSHAKE128

func sha3.NewSHAKE128() *sha3.SHAKE

NewSHAKE128 returns a new SHAKE128 XOF.

Requirements

  • The OpenSSL backend requires OpenSSL 3.3 or higher.

Implementation

OpenSSL (click for details)

The XOF is generated using EVP_MD_CTX_new and EVP_DigestInit_ex with the SHAKE128 algorithm.

The XOF methods are implemented as follows:

CNG (click for details)

The XOF is generated using BCryptCreateHash with the BCRYPT_CSHAKE128_ALGORITHM algorithm identifier.

The XOF methods are implemented as follows:

func NewSHAKE256

func sha3.NewSHAKE256() *sha3.SHAKE

NewSHAKE256 returns a new SHAKE256 XOF. It is implemented as sha3.NewSHAKE128 but with the SHAKE256 algorithm (OpenSSL) or the BCRYPT_CSHAKE256_ALGORITHM algorithm identifier (CNG). It is subject to the same requirements.

func NewCSHAKE128

func sha3.NewCSHAKE128(N, S []byte) *sha3.SHAKE

NewCSHAKE128 returns a new cSHAKE128 XOF, customized with the function-name string N and the customization string S. When both N and S are empty it is equivalent to sha3.NewSHAKE128.

Requirements

  • The OpenSSL backend does not implement this function.

Implementation

CNG (click for details)

The XOF is generated using BCryptCreateHash with the BCRYPT_CSHAKE128_ALGORITHM algorithm identifier. The function-name string N and the customization string S are set with the BCRYPT_FUNCTION_NAME_STRING and BCRYPT_CUSTOMIZATION_STRING properties.

The XOF methods are implemented as follows:

func NewCSHAKE256

func sha3.NewCSHAKE256(N, S []byte) *sha3.SHAKE

NewCSHAKE256 returns a new cSHAKE256 XOF. It is implemented as sha3.NewCSHAKE128 but with the BCRYPT_CSHAKE256_ALGORITHM algorithm identifier, and is subject to the same requirements.

crypto/sha512

Package sha512 implements the SHA-384, SHA-512, SHA-512/224, and SHA-512/256 hash algorithms as defined in FIPS 180-4.

func New

func sha512.New() hash.Hash

New returns a new hash.Hash computing the SHA-512 checksum.

Implementation

OpenSSL (click for details)

The hash is generated using EVP_MD_CTX_new and EVP_DigestInit_ex with the algorithm EVP_sha512.

The hash.Hash methods are implemented as follows:

CNG (click for details)

The hash is generated using BCryptCreateHash with the algorithm identifier BCRYPT_SHA512_ALGORITHM.

The hash.Hash methods are implemented as follows:

func New384

func sha512.New384() hash.Hash

New384 returns a new hash.Hash computing the SHA-384 checksum.

Implementation

OpenSSL (click for details)

The hash is generated using EVP_MD_CTX_new and EVP_DigestInit_ex with the algorithm EVP_sha384.

The hash.Hash methods are implemented as follows:

CNG (click for details)

The hash is generated using BCryptCreateHash with the algorithm identifier BCRYPT_SHA384_ALGORITHM.

The hash.Hash methods are implemented as follows:

func New512_224

sha512.New512_224 is not implemented by any backend.

func New512_256

sha512.New512_256 is not implemented by any backend.

func Sum384

func sha512.Sum384(data []byte) [48]byte

Sum384 returns the SHA384 checksum of the data. It internally uses sha512.New384() to compute the checksum.

func Sum512

func sha512.Sum512(data []byte) [64]byte

Sum512 returns the SHA512 checksum of the data. It internally uses sha512.New() to compute the checksum.

func Sum512_224

sha512.Sum512_224 is not implemented by any backend.

func Sum512_256

sha512.Sum512_256 is not implemented by any backend.

crypto/rsa

Package rsa implements RSA encryption as specified in PKCS #1 and RFC 8017.

func DecryptOAEP

func rsa.DecryptOAEP(h hash.Hash, rand io.Reader, priv *rsa.PrivateKey, ciphertext []byte, label []byte) ([]byte, error)

DecryptOAEP decrypts ciphertext using RSA-OAEP.

Requirements

  • h must be the result of one of the following functions: sha1.New(), sha224.New(), sha256.New(), sha384.New(), or sha512.New().
  • The CNG backend does not support sha224.New().
  • rand is not used. Blinding, if implemented, is delegated to crypto backend.

Implementation

OpenSSL (click for details)

ciphertext is decrypted using EVP_PKEY_decrypt with RSA_PKCS1_OAEP_PADDING pad mode.

CNG (click for details)

ciphertext is decrypted using BCryptDecrypt with BCRYPT_OAEP_PADDING_INFO padding information and BCRYPT_PAD_OAEP pad mode.

func DecryptPKCS1v15

func rsa.DecryptPKCS1v15(rand io.Reader, priv *rsa.PrivateKey, ciphertext []byte) ([]byte, error)

DecryptPKCS1v15 decrypts a plaintext using RSA and the padding scheme from PKCS #1 v1.5.

Requirements

  • rand is not used. Blinding, if implemented, is delegated to crypto backend.
  • priv.Primes length must be 2 when using the CNG backend.

Implementation

OpenSSL (click for details)

ciphertext is decrypted using EVP_PKEY_decrypt with RSA_PKCS1_PADDING pad mode.

CNG (click for details)

ciphertext is decrypted using BCryptDecrypt with BCRYPT_PAD_PKCS1 pad mode.

func DecryptPKCS1v15SessionKey

func rsa.DecryptPKCS1v15SessionKey(rand io.Reader, priv *PrivateKey, ciphertext []byte, key []byte) error

DecryptPKCS1v15SessionKey decrypts a session key using RSA and the padding scheme from PKCS #1 v1.5.

Requirements

  • rand is not used. Blinding, if implemented, is delegated to crypto backend.
  • priv.Primes length must be 2 when using the CNG backend.

Implementation

OpenSSL (click for details)

ciphertext is decrypted using EVP_PKEY_decrypt with RSA_PKCS1_PADDING pad mode and copied into key.

CNG (click for details)

ciphertext is decrypted using BCryptDecrypt with BCRYPT_PAD_PKCS1 pad mode and copied into key.

func EncryptPKCS1v15

func rsa.EncryptPKCS1v15(rand io.Reader, pub *rsa.PublicKey, msg []byte) ([]byte, error)

Requirements

  • rand must be boring.RandReader, else SignPSS will panic. crypto/rand.Reader normally meets this invariant, as it is assigned to boring.RandReader in the crypto/rand init function.

Implementation

OpenSSL (click for details)

msg is encrypted using EVP_PKEY_encrypt with RSA_PKCS1_PADDING pad mode.

CNG (click for details)

msg is encrypted using BCryptEncrypt with BCRYPT_PAD_PKCS1 pad mode.

func SignPKCS1v15

func rsa.SignPKCS1v15(rand io.Reader, priv *rsa.PrivateKey, hash crypto.Hash, hashed []byte) ([]byte, error)

SignPKCS1v15 calculates the signature of hashed using RSASSA-PKCS1-V1_5-SIGN from RSA PKCS #1 v1.5.

Requirements

  • rand is not used. Blinding, if implemented, is delegated to crypto backend.
  • priv.Primes length must be 2 when using the CNG backend.
  • hash must be one of the following values: crypto.MD5, crypto.MD5SHA1, crypto.SHA1, crypto.SHA224, crypto.SHA256, crypto.SHA384, or crypto.SHA512. Else SignPKCS1v15 will fail.
  • The CNG backend does not support crypto.MD5SHA1 nor crypto.SHA224.
  • hashed must be the result of hashing a message using a FIPS compliant hashing algorithm.

Implementation

OpenSSL (click for details)

hashed is signed using EVP_PKEY_sign with RSA_PKCS1_PADDING.

CNG (click for details)

hashed is signed using BCryptSignHash with BCRYPT_PKCS1_PADDING_INFO padding information and BCRYPT_PAD_PKCS1 pad mode.

func SignPSS

func rsa.SignPSS(rand io.Reader, priv *rsa.PrivateKey, hash crypto.Hash, digest []byte, opts *PSSOptions) ([]byte, error)

SignPSS calculates the signature of digest using PSS.

Requirements

  • rand must be boring.RandReader, else SignPSS will panic. crypto/rand.Reader normally meets this invariant, as it is assigned to boring.RandReader in the crypto/rand init function.
  • priv.Primes length must be 2 when using the CNG backend.
  • hash can be one of the following values: crypto.MD5, crypto.MD5SHA1, crypto.SHA1, crypto.SHA224, crypto.SHA256, crypto.SHA384, or crypto.SHA512. Else SignPSS will fail.
  • The CNG backend does not support crypto.MD5SHA1 nor crypto.SHA224.
  • digest must be the result of hashing a message using a FIPS compliant hashing algorithm.
  • opts can be nil.
  • opts.SaltLength can either be a number of bytes, or one of the following constants: rsa.PSSSaltLengthAuto and rsa.PSSSaltLengthEqualsHash.

Implementation

OpenSSL (click for details)

digest is signed using EVP_PKEY_sign with RSA_PKCS1_PSS_PADDING pad mode.

CNG (click for details)

digest is signed using BCryptSignHash with BCRYPT_PSS_PADDING_INFO padding information and BCRYPT_PAD_PSS pad mode.

func VerifyPKCS1v15

func rsa.VerifyPKCS1v15(pub *rsa.PublicKey, hash crypto.Hash, hashed []byte, sig []byte) error

VerifyPKCS1v15 verifies an RSA PKCS #1 v1.5 signature.

Requirements

  • hash can be one of the following values: crypto.MD5, crypto.MD5SHA1, crypto.SHA1, crypto.SHA224, crypto.SHA256, crypto.SHA384, or crypto.SHA512. Else SignPSS will fail.
  • The CNG backend does not support crypto.MD5SHA1 nor crypto.SHA224.
  • hashed must be the result of hashing a message using a FIPS compliant hashing algorithm.

Implementation

OpenSSL (click for details)

sig is verified using EVP_PKEY_verify with RSA_PKCS1_PADDING pad mode.

CNG (click for details)

sig is verified using BCryptVerifySignature with BCRYPT_PKCS1_PADDING_INFO padding information and BCRYPT_PAD_PKCS1 pad mode.

func VerifyPSS

func rsa.VerifyPSS(pub *rsa.PublicKey, hash crypto.Hash, digest []byte, sig []byte, opts *PSSOptions) error

VerifyPSS verifies a PSS signature.

Requirements

  • hash can be one of the following values: crypto.MD5, crypto.MD5SHA1, crypto.SHA1, crypto.SHA224, crypto.SHA256, crypto.SHA384, or crypto.SHA512. Else VerifyPSS will fail.
  • The CNG backend does not support crypto.MD5SHA1 nor crypto.SHA224.
  • digest must be the result of hashing a message using a FIPS compliant hashing algorithm.
  • opts can be nil.
  • opts.SaltLength can either be a number of bytes, or one of the following constants: rsa.PSSSaltLengthAuto and rsa.PSSSaltLengthEqualsHash.
  • The CNG backend does not support nil opts nor rsa.PSSSaltLengthAuto.

Implementation

OpenSSL (click for details)

sig is verified using EVP_PKEY_verify with RSA_PKCS1_PSS_PADDING pad mode.

CNG (click for details)

sig is verified using BCryptVerifySignature with BCRYPT_PSS_PADDING_INFO padding information and BCRYPT_PAD_PSS pad mode.

func GenerateKey

func rsa.GenerateKey(rand io.Reader, bits int) (priv *rsa.PrivateKey, err error)

GenerateKey generates a public and private key pair.

Requirements

  • rand must be boring.RandReader. crypto/rand.Reader normally meets this invariant as it is assigned to boring.RandReader in the crypto/rand init function.
  • bits must be either 2048 or 3072.

Implementation

OpenSSL (click for details)

priv is a wrapper around EVP_PKEY generated using EVP_PKEY_keygen.

CNG (click for details)

priv is generated using BCryptGenerateKeyPair with the algorithm identifier BCRYPT_RSA_ALGORITHM.

func GenerateMultiPrimeKey

func rsa.GenerateMultiPrimeKey(rand io.Reader, nprimes int, bits int) (priv *rsa.PrivateKey, err error)

GenerateMultiPrimeKey generates a multi-prime RSA keypair of the given bit size.

Requirements

  • rand must be boring.RandReader. crypto/rand.Reader normally meets this invariant as it is assigned to boring.RandReader in the crypto/rand init function.
  • nprimes must be 2.
  • bits must be either 2048 or 3072.

Implementation

OpenSSL (click for details)

priv is a wrapper around EVP_PKEY generated using EVP_PKEY_keygen.

CNG (click for details)

priv is generated using BCryptGenerateKeyPair with the algorithm identifier BCRYPT_RSA_ALGORITHM.

func PrivateKey.Decrypt

func (priv *PrivateKey) Decrypt(rand io.Reader, ciphertext []byte, opts crypto.DecrypterOpts) (plaintext []byte, err error)

Decrypt decrypts ciphertext with priv.

The decrypt function depends on opts:

  • If opts is nil, it calls rsa.DecryptPKCS1v15(rand, priv, ciphertext).
  • If opts type is *rsa.OAEPOptions, it calls rsa.DecryptOAEP(opts.Hash.New(), rand, priv, ciphertext, opts.Label).
  • If opts type is *rsa.OAEPOptions and ops.Hash is different than opts.MGFHash, it falls back to standard Go crypto.
  • If opts type is *rsa.PKCS1v15DecryptOptions and opts.SessionKeyLen > 0, it calls rsa.DecryptPKCS1v15SessionKey(rand, priv, ciphertext, plaintext) with a random plaintext.
  • If opts type is *rsa.PKCS1v15DecryptOptions and opts.SessionKeyLen == 0, it calls rsa.DecryptPKCS1v15(rand, priv, ciphertext).
  • Else it returns an error.

Each case may impose additional parameter requirements. After determining which case applies, check the linked function to find the additional restrictions.

func PrivateKey.Sign

func (priv *rsa.PrivateKey) Sign(rand io.Reader, digest []byte, opts crypto.SignerOpts) ([]byte, error)

Sign signs digest with priv.

The sign function depends on opts:

  • If opts type is *rsa.PSSOptions, it calls rsa.SignPSS(rand, priv, pssOpts.Hash, digest, opts)
  • Else it calls rsa.SignPKCS1v15(rand, priv, opts.HashFunc(), digest).

Each case may impose additional parameter requirements. After determining which case applies, check the linked function to find the additional restrictions.

crypto/subtle

Does not contain crypto primitives, out of FIPS scope.

crypto/tls

Package tls partially implements TLS 1.2, as specified in RFC 5246, and TLS 1.3, as specified in RFC 8446.

Package tls will automatically use FIPS compliant primitives implemented in other crypto packages.

Since Go 1.22, the Microsoft build of Go runtime automatically enforces that tls only uses FIPS-approved settings when running in FIPS mode. Prior to Go 1.22, a program using tls must import the crypto/tls/fipsonly package to be compliant with these restrictions.

Since Go 1.26, the Microsoft build of Go applies a set of Microsoft-recommended TLS defaults (for example, preferring AES-256 over AES-128 and enabling ML-KEM-based key exchange groups). This is controlled by the ms_tlsprofile GODEBUG setting, which defaults to ms_tlsprofile=default and can be set to ms_tlsprofile=off to restore the upstream Go defaults. The ms_tlsx25519 GODEBUG setting (default ms_tlsx25519=1) controls whether the X25519 and X25519MLKEM768 groups are enabled by default. These settings affect the default selection only; the FIPS-only restrictions below are always enforced in FIPS mode.

When using TLS in FIPS-only mode the TLS handshake has the following restrictions:

  • TLS versions:

    • tls.VersionTLS12
    • tls.VersionTLS13

  • Key exchange groups:

    • tls.CurveP256
    • tls.CurveP384
    • tls.CurveP521
    • tls.X25519MLKEM768
    • tls.SecP256r1MLKEM768
    • tls.SecP384r1MLKEM1024
    • tls.MLKEM1024

    The standalone tls.X25519 group is not used in FIPS mode; only the ML-KEM-based hybrid and pure groups above (whose security relies on the FIPS-approved ML-KEM component) and the NIST curves are used. The ML-KEM groups are only offered when supported by the crypto backend.

  • Cipher suites for TLS 1.2:

    • tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
    • tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    • tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
    • tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
    • tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
    • tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

  • Cipher suites for TLS 1.3:

    • tls.TLS_AES_256_GCM_SHA384
    • tls.TLS_AES_128_GCM_SHA256

    The ChaCha20-Poly1305 cipher suites (such as tls.TLS_CHACHA20_POLY1305_SHA256) are offered by default outside FIPS mode but are not permitted in FIPS-only mode, as ChaCha20-Poly1305 is not a FIPS-approved algorithm.

  • x509 certificate public key:

    • rsa.PublicKey with a bit length of 2048 or 3072. Bit length of 4096 is still not supported, see this issue for more info.
    • ecdsa.PublicKey with a supported elliptic curve.

  • Signature algorithms:

    • tls.PSSWithSHA256
    • tls.PSSWithSHA384
    • tls.PSSWithSHA512
    • tls.PKCS1WithSHA256
    • tls.ECDSAWithP256AndSHA256
    • tls.PKCS1WithSHA384
    • tls.ECDSAWithP384AndSHA384
    • tls.PKCS1WithSHA512
    • tls.ECDSAWithP521AndSHA512