config: enforce AES-GCM in FIPS mode (#12265)

This commit enforces the usage of AES-256
for config and IAM data en/decryption in FIPS
mode.

Further, it improves the implementation of
`fips.Enabled` by making it a compile time
constant. Now, the compiler is able to evaluate
the any `if fips.Enabled { ... }` at compile time
and eliminate unused code.

Signed-off-by: Andreas Auernhammer <aead@mail.de>

pkg/fips/api.go

@@ -34,14 +34,13 @@ package fips
 
 import "crypto/tls"
 
-// Enabled returns true if and only if FIPS 140-2 support
-// is enabled.
+// Enabled indicates whether cryptographic primitives,
+// like AES or SHA-256, are implemented using a FIPS 140
+// certified module.
 //
-// FIPS 140-2 requires that only specifc cryptographic
-// primitives, like AES or SHA-256, are used and that
-// those primitives are implemented by a FIPS 140-2
-// certified cryptographic module.
-func Enabled() bool { return enabled }
+// If FIPS-140 is enabled no non-NIST/FIPS approved
+// primitives must be used.
+const Enabled = enabled
 
 // CipherSuitesDARE returns the supported cipher suites
 // for the DARE object encryption.

pkg/fips/fips.go

@@ -1,5 +1,3 @@
-// +build fips
-
 // Copyright (c) 2015-2021 MinIO, Inc.
 //
 // This file is part of MinIO Object Storage stack
@@ -17,6 +15,8 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+// +build fips,linux,amd64
+
 package fips
 
 import (
@@ -25,7 +25,7 @@ import (
 	"github.com/minio/sio"
 )
 
-var enabled = true
+const enabled = true
 
 func cipherSuitesDARE() []byte {
 	return []byte{sio.AES_256_GCM}

pkg/fips/no_fips.go

@@ -15,6 +15,8 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+// +build !fips
+
 package fips
 
 import (
@@ -23,7 +25,7 @@ import (
 	"github.com/minio/sio"
 )
 
-var enabled = false
+const enabled = false
 
 func cipherSuitesDARE() []byte {
 	return []byte{sio.AES_256_GCM, sio.CHACHA20_POLY1305}