The FIPS 140-3 Go Cryptographic Module

[NewsBot]

A new Go blog post/announcement has been posted!

<div class="Article" data-slug="/blog/fips140">

<h1 class="small"><a href="/blog/">The Go Blog</a></h1>


<h1>The FIPS 140-3 Go Cryptographic Module</h1>
  
  <p class="author">
  Filippo Valsorda (Geomys), Daniel McCarney (Geomys),  and Roland Shoemaker (Google)<br>
  15 July 2025
  </p>
  
  <p>FIPS 140 is a standard for cryptography implementations and, although it doesn’t

necessarily improve security, FIPS 140 compliance is a requirement in certain
regulated environments that are increasingly adopting Go. Until now, FIPS 140
compliance has been a significant source of friction for Go users, requiring
unsupported solutions with safety, developer experience, functionality, release
velocity, and compliance issues.

Go is addressing this growing need with native FIPS 140 support built right into the standard library and the go command, making Go the easiest, most secure way to comply with FIPS 140. The FIPS 140-3 validated Go Cryptographic Module now underlies Go’s built-in crypto libraries, starting with the Go Cryptographic Module v1.0.0 that is included in Go 1.24, released last February.

The v1.0.0 module has been awarded Cryptographic Algorithm Validation Program (CAVP) certificate A6650, was submitted to the Cryptographic Module Validation Program (CMVP), and reached the Modules In Process List in May. Modules on the MIP list are awaiting NIST review and can already be deployed in certain regulated environments.

Geomys led the implementation effort in col...

Get the full details here: The FIPS 140-3 Go Cryptographic Module - The Go Programming Language