-
Notifications
You must be signed in to change notification settings - Fork 34
Open
Labels
Description
We use BCryptGetFipsAlgorithmMode to know if Windows is running on FIPS mode.
The Windows team has informed us that that function is deprecated (although the docs still don't say that) and shouldn't be used. Windows is always FIPS compliant regardless of what that functions says.
We should treat Windows in the same way as we treat Darwin with respect to FIPS mode:
- Windows is always FIPS compliant, so running with
GODEBUG=fips140=onshould always succeed regardless ofBCryptGetFipsAlgorithmMode. fips140.Enabledshould not take into account the system-wide configuration.