[go] crypto/internal/fips140test: add entropy SHA2-384 testing

0 views

Skip to first unread message

Gopher Robot (Gerrit)

unread,

Oct 22, 2025, 8:59:24 PM (12 hours ago) Oct 22

to Daniel McCarney, goph...@pubsubhelper.golang.org, golang-...@googlegroups.com, David Chase, Roland Shoemaker, Go LUCI, golang-co...@googlegroups.com

Gopher Robot submitted the change

Change information

Commit message:

crypto/internal/fips140test: add entropy SHA2-384 testing

The crypto/internal/fips140/entropy package vendors a minimal
implementation of SHA2-384 to insulate it from changes in the FIPS
module implementation. This means it also requires ACVP testing separate
from the FIPS module implementation. This commit implements the
required ACVP testing support.

There's no way via the ACVP protocol, or acvptool, to specify that we
want to test a specific SHA2-384 implementation compared to normal. We
use a new environment variable (GOENTROPYSOURCEACVP=1) to make that
distinction.

The capabilities we advertise when testing the entropy SHA2-384
implementation are limited to something that best describes the
input sizes that the entropy module's implementation supports within the
requirements imposed by ACVP. We allow 144 byte messages (3*digest size)
to support MCT and in particular the "standard" MCT algorithm, and allow
1024 byte messages as the production supported message size used by the
entropy module itself.