MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2025-11-07 12:52:58 -05:00
Code Issues Packages Projects Releases Wiki Activity

use crypto/sha256 for FIPS 140-2 compliance (#11623)

Browse Source 
This commit replaces the usage of
github.com/minio/sha256-simd with crypto/sha256
of the standard library in all non-performance
critical paths.

This is necessary for FIPS 140-2 compliance which
requires that all crypto. primitives are implemented
by a FIPS-validated module.

Go can use the Google FIPS module. The boringcrypto
branch of the Go standard library uses the BoringSSL
FIPS module to implement crypto. primitives like AES
or SHA256.

We only keep github.com/minio/sha256-simd when computing
the content-SHA256 of an object. Therefore, this commit
relies on a build tag `fips`.

When MinIO is compiled without the `fips` flag it will
use github.com/minio/sha256-simd. When MinIO is compiled
with the fips flag (go build --tags "fips") then MinIO
uses crypto/sha256 to compute the content-SHA256.
This commit is contained in:
Andreas Auernhammer
2021-02-24 18:00:15 +01:00
committed by GitHub
parent 03172b89e2
commit c1a49be639
19 changed files with 76 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
cmd/signature-v4.go
View File

@@ -26,6 +26,7 @@ package cmd
import (
"bytes"
"crypto/sha256"
"crypto/subtle"
"encoding/hex"
"net/http"
@@ -38,7 +39,6 @@ import (
"github.com/minio/minio-go/v7/pkg/s3utils"
"github.com/minio/minio-go/v7/pkg/set"
xhttp "github.com/minio/minio/cmd/http"
sha256 "github.com/minio/sha256-simd"
)
// AWS Signature Version '4' constants.