crypto/x509: Incorrect RSA key size limitations in BoringCrypto/FIPS 140-2 mode

[cipherboy]

What version of Go are you using (go version)?

$ go version
go version go1.18.3b7 linux/amd64

Does this issue reproduce with the latest release?

Yes: https://github.com/golang/go/blob/master/src/crypto/x509/boring.go#L24

What operating system and processor architecture are you using (go env)?

Linux/amd64.

go env Output

$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/cipherboy/.cache/go-build"
GOENV="/home/cipherboy/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/home/cipherboy/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/home/cipherboy/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.18.3b7"
GCCGO="gccgo"
GOAMD64="v1"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/dev/null"
GOWORK=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build2222689251=/tmp/go-build -gno-record-gcc-switches"

What did you do?

Attempt to use a larger RSA key (e.g., 4096 bits) in a TLS connection.

What did you expect to see?

Success. Per Hashicorp's recent discussions with Leidos around a Letter of Attestation for Vault based on BoringCrypto's 3678 certificate, larger key sizes are allowed. In particular, this limitation shouldn't be necessary as, per our lab contact (and with permission to quote in the interest of getting this change upstreamed):

P. said:

FIPS 140-2 IG A.14 allows for one to use RSA key sizes >= 2048 bits, so long as the ones that are testable have been tested. At the time of the BoringCrypto certification, only up to 3072 was testable, so IG A.14 would allow you to use anything above that as well.

Since the relevant BC certificate has both 2048 and 3072 tested, we sould simplify the check to >= 2048.

Let me know if this is agreeable and I can open a PR.

What did you see instead?

Failure. :-)

[heschi]

cc @golang/security

[qmuntal]

Related to #41147

[cipherboy]

Notably, the new info over that ticket (sorry for the duplicate!) is that we don't need to restrict to 4096 and we don't need a new cert; the existing cert is fine per our lab.

[rolandshoemaker]

Hi @cipherboy, since #41147 already contains additional context for this, could you post your rational for why this change can be made there, and we can continue the discussion. Thanks!