FIPS analysis to support dynamic call edges
@qmuntal is already working on this.
Since Nov 16, 2021.
- Dominant language
- Go
- Stars
- 431
- Forks
- 44
- Avg merge
- 21h 18m
- Merged PRs (30d)
- 30
Description
In go/crypto all algorithms are exposed as top level functions, so when searching for entry points in the FIPS analysis we can skip exported methods of exported structs.
On the other hand, go/crypto makes heavy use of interfaces (such as crypto.Hash that are implemented as unexported structs, and these structs do contain crypto primitives that should be tracked.
The difficulty comes from the dynamic nature of interfaces: when an interface method is called, knowing the concrete type of the receiver is not straightforward as it requires knowing when it has been instantiated, which may be far away from the call.
Luckily for us, the boring bridges almost always use a simple v := boring.NewFoo() -> v.Call -> v.Call pattern, so my guess is that we can resolve the vast majority of cases without much effort. I.e.:
https://github.com/microsoft/go/blob/01b0e9574ff803fbe86721ef9dc07c50f4c5acba/src/crypto/sha512/sha512.go#L215-L222
https://github.com/microsoft/go/blob/01b0e9574ff803fbe86721ef9dc07c50f4c5acba/src/crypto/sha512/sha512.go#L346-L358
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.