From 9caf3f4dfc7e0089d27812493b04b1cb64c5d04b Mon Sep 17 00:00:00 2001 From: yuhan6665 <1588741+yuhan6665@users.noreply.github.com> Date: Sat, 10 May 2025 15:28:42 -0400 Subject: [PATCH] crypto/tls: document FIPS 140-3 mode behavior Change-Id: I6a6a465612cf76d148b9758ee3fcdc8606497830 Reviewed-on: https://go-review.googlesource.com/c/go/+/648835 Reviewed-by: Daniel McCarney LUCI-TryBot-Result: Go LUCI Auto-Submit: Filippo Valsorda Reviewed-by: Roland Shoemaker Reviewed-by: Ian Lance Taylor --- tls.go | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/tls.go b/tls.go index 3016766..8de6f54 100644 --- a/tls.go +++ b/tls.go @@ -2,8 +2,20 @@ // Use of this source code is governed by a BSD-style // license that can be found in the LICENSE-Go file. -// Server side implementation of REALITY protocol, a fork of package tls in Go 1.20. +// Server side implementation of REALITY protocol, a fork of package tls in latest Go. // For client side, please follow https://github.com/XTLS/Xray-core/blob/main/transport/internet/reality/reality.go. + +// Package tls partially implements TLS 1.2, as specified in RFC 5246, +// and TLS 1.3, as specified in RFC 8446. +// +// # FIPS 140-3 mode +// +// When the program is in [FIPS 140-3 mode], this package behaves as if +// only protocol versions, cipher suites, signature algorithms, and +// key exchange algorithms approved by NIST SP 800-52r2 are implemented. +// Others are silently ignored and not negotiated. +// +// [FIPS 140-3 mode]: https://go.dev/doc/security/fips140 package reality // BUG(agl): The crypto/tls package only implements some countermeasures