{"record":{"id":"c0d289fd440f9cf8","repo":"slackhq/nebula","slug":"pki-use-of-chachapoly-is-not-allowed-in-fips-140","errorCode":null,"errorMessage":"pki: use of ChaChaPoly is not allowed in FIPS 140-only mode","messagePattern":"pki: use of ChaChaPoly is not allowed in FIPS 140-only mode","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pki.go","lineNumber":265,"sourceCode":"\tswitch curve {\n\tcase cert.Curve_CURVE25519:\n\t\tif fips140Enforced {\n\t\t\treturn nil, errors.New(\"pki: use of Curve25519 is not allowed in FIPS 140-only mode\")\n\t\t}\n\t\tdhFunc = noise.DH25519\n\tcase cert.Curve_P256:\n\t\tif pkcs11backed {\n\t\t\tdhFunc = noiseutil.DHP256PKCS11\n\t\t} else {\n\t\t\tdhFunc = noiseutil.DHP256\n\t\t}\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unsupported curve: %s\", curve)\n\t}\n\n\tif cipher == \"chachapoly\" {\n\t\tif fips140Enforced {\n\t\t\treturn nil, errors.New(\"pki: use of ChaChaPoly is not allowed in FIPS 140-only mode\")\n\t\t}\n\t\treturn noise.NewCipherSuite(dhFunc, noise.CipherChaChaPoly, noise.HashSHA256), nil\n\t}\n\treturn noise.NewCipherSuite(dhFunc, noiseutil.CipherAESGCM, noise.HashSHA256), nil\n}\n\nfunc (cs *CertState) String() string {\n\tb, err := cs.MarshalJSON()\n\tif err != nil {\n\t\treturn fmt.Sprintf(\"error marshaling certificate state: %v\", err)\n\t}\n\treturn string(b)\n}\n\nfunc (cs *CertState) MarshalJSON() ([]byte, error) {\n\tmsg := []json.RawMessage{}\n\tif cs.v1Cert != nil {\n\t\tb, err := cs.v1Cert.MarshalJSON()","sourceCodeStart":247,"sourceCodeEnd":283,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/pki.go#L247-L283","documentation":"newCipherSuite rejects the ChaCha20-Poly1305 Noise cipher when FIPS 140-only mode is enforced, since ChaChaPoly is not a FIPS-approved AEAD. The check runs after the DH curve is resolved: any cipher == \"chachapoly\" with fips140Enforced set returns this error instead of building the cipher suite.","triggerScenarios":"Node configuration selects cipher \"chachapoly\" (the Noise ChaChaPoly suite) while FIPS 140-only mode is enforced (GODEBUG=fips140=only or FIPS-enforcing OS), causing newCipherSuite to return this error during newCertState/cipher suite construction.","commonSituations":"FIPS-host deployments retaining default/non-FIPS configs specifying chachapoly; mixed fleets where a template written for non-FIPS nodes is applied to FIPS nodes; enabling FIPS mode via environment/OS update without revisiting cipher settings.","solutions":["Change the cipher configuration from \"chachapoly\" to AES-GCM (default path via noiseutil.CipherAESGCM), which is FIPS-approved.","If policy allows, disable FIPS 140-only mode so ChaChaPoly remains available.","Roll the config change fleet-wide with startup validation that rejects chachapoly under FIPS enforcement.","Confirm AES-NI/hardware AES support on the hosts so AES-GCM performance is acceptable.","Document cipher requirements per environment so FIPS and non-FIPS fleets use distinct config templates."],"exampleFix":"// before: config.toml on a FIPS host\n[metrics/pki]\ncipher = \"chachapoly\"\n// after\ncipher = \"aesgcm\"\n// startup validation:\nif fips140Enforced && cipher == \"chachapoly\" {\n    return fmt.Errorf(\"config error: chachapoly is not FIPS approved; use aesgcm\")\n}","handlingStrategy":"fallback","validationCode":"// Go: reject unsafe cipher config before starting\nif fips140Enforced && cipher == \"chachapoly\" {\n    return fmt.Errorf(\"cipher chachapoly is not allowed in FIPS mode; use aesgcm\")\n}","typeGuard":null,"tryCatchPattern":"cs, err := newCipherSuite(curve, pkcs11backed, cipher, fips140Enforced)\nif err != nil && strings.Contains(err.Error(), \"ChaChaPoly is not allowed in FIPS\") {\n    log.Warn(\"falling back to AES-GCM for FIPS compliance\")\n    cs, err = newCipherSuite(curve, pkcs11backed, \"aesgcm\", fips140Enforced)\n}\nif err != nil {\n    return err\n}","preventionTips":["Default to AES-GCM ciphers in FIPS environments; reserve chachapoly for non-FIPS fleets.","Test newCipherSuite under fips140=only in CI to catch cipher-policy drift.","Document that ChaChaPoly is unavailable whenever FIPS 140-only enforcement is on.","Confirm hardware AES support so the AES-GCM fallback performs acceptably."],"tags":["fips","crypto","chacha20-poly1305","noise","pki"],"backgroundTag":"fips-algorithm-not-allowed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}