Skip to content

Stop using BCryptGetFipsAlgorithmMode #1742

@qmuntal

Description

@qmuntal

We use BCryptGetFipsAlgorithmMode to know if Windows is running on FIPS mode.

The Windows team has informed us that that function is deprecated (although the docs still don't say that) and shouldn't be used. Windows is always FIPS compliant regardless of what that functions says.

We should treat Windows in the same way as we treat Darwin with respect to FIPS mode:

  • Windows is always FIPS compliant, so running with GODEBUG=fips140=on should always succeed regardless of BCryptGetFipsAlgorithmMode.
  • fips140.Enabled should not take into account the system-wide configuration.

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions