sshalgo

Overview ¶

Package sshalgo provides the SSH algorithm sets a server should offer, filtered for FIPS 140-3 compliance when the binary is built with the fips build tag.

Without the fips build tag the functions return golang.org/x/crypto/ssh's own algorithm sets unchanged, so callers can wire them in unconditionally and let the build tag decide the policy:

config := &ssh.ServerConfig{}

algorithms := sshalgo.DefaultAlgorithms()
config.Ciphers = algorithms.Ciphers
config.MACs = algorithms.MACs
config.KeyExchanges = algorithms.KeyExchanges

Policy ¶

The package's exclusion lists are GitLab's compliance determination and apply on every backend. They are a floor: a backend may narrow the result further, never widen it.

X25519 key agreement is excluded everywhere, including the ML-KEM768/X25519 hybrid that upstream Go approves under GODEBUG=fips140=on. Two independent reasons, both established when FIPS SSH support was first added to v1: the FIPS 140-3 Implementation Guidance excludes curves that are in SP 800-186 but not SP 800-56Arev3 from key agreement, naming ECDH X25519 explicitly (labkit!216); and these algorithms panic on the golang-fips toolchain (labkit commit c91581b). GitLab's determination is stricter than the module's, and where they differ GitLab's wins.

Under the native Go Cryptographic Module (built with GOFIPS140, so crypto/fips140.Enabled reports true) the result is narrowed further to what x/crypto/ssh can actually negotiate: the non-approved algorithms are never registered in its internal maps, and ssh.Config.SetDefaults - which ssh.NewServerConn and ssh.NewClientConn both call unconditionally - drops anything absent from them. Deriving that narrowing rather than hand-maintaining a second list keeps this package in step with the linked module, whose contents depend on GOFIPS140 and may change across Go versions.

Under BoringCrypto (the golang-fips toolchain) crypto/fips140.Enabled reports false, because the OpenSSL backend is invisible to crypto/fips140. x/crypto applies no policy of its own there, so nothing narrows the result.

This package is separate from gitlab.com/gitlab-org/labkit/v2/fips so that services which only need to report their FIPS posture do not take on a golang.org/x/crypto dependency.