Add FIPS (BoringCrypto) support

[jonacto-google]

Feature Description

In pursuit of FedRamp authorization, there's a customer need to ensure that all cryptographic modules in use within their GCP environment are FIPS validated. BoringCrypto is one such module that could be used by CloudSQL Auth proxy to meet this requirement.

Sample code

// sample code here

Alternatives Considered

No response

Additional Details

No response

[enocom]

Thanks for the request.

I think this is as simple as running the following command for all our existing architecture / OS combinations:

# CGO might be required
CGO_ENABLED=1 GOEXPERIMENT=boringcrypt go build

And as of golang/go#64717, Go supports TLS 1.3 with boringcrypto.

Since Go makes no statements about FIPS compliance AFAIK, I think we can't either. However, we can certainly publish binaries built against boringcrypto. We'll need some time to validate these builds but can probably do that within the next few releases.

[enocom]

We're going to hold off on this since boringcrypto doesn't currently support TLS 1.3.