Thread

Golang: Crypto/fips140: do not bloat crypto code unnecessarily

19 points · 8 comments · zx2c4

westurner · 1790434779 · focus · HN ↗
Isn't there still need for non- or post- FIPS-140 -like cipher restrictions in non FIPS-140 environments?
How much code is needed to implement Classical+PQ (Hybrid PQ) or PQ-only (Only PQ) cipher selection restrictions just?
FWIU, with golang:
```
  # This allows X25519MLKEM768 (Hybrid PQ)
  GODEBUG=fips140=on

  # This prevents any PQ ciphers from being used:
  GODEBUG=fips140=only
```
tlsref needs to be revised to specify PQ cipher lists.
1. twiss · 1790586307 · focus · HN ↗
  FIPS-140 doesn't yet require PQC, nor does Go in FIPS mode (or any other mode).
  So, if you only want PQC, you'll have to do that manually either way. But, I think you'll find many servers aren't ready for that: <a href="https://www.netmeister.org/blog/pqc-use-2026-09.html" rel="nofollow">https://www.netmeister.org/blog/pqc-use-2026-09.html
  1. westurner · 1790625227 · focus · HN ↗
    Some notes on PQC and MTC roadmaps on "Shipping post-quantum cryptography to Python – The Trail of Bits Blog" <a href="https://news.ycombinator.com/item?id=48789958">https://news.ycombinator.com/item?id=48789958
    mozilla/ssl-config-generator is now tlsref/configurar: <a href="https://github.com/tlsref/configurator" rel="nofollow">https://github.com/tlsref/configurator .. <a href="http://configurator.tlsref.org/" rel="nofollow">http://configurator.tlsref.org/

Unofficial Hacker News client; not affiliated with Y Combinator.