Golang: Crypto/fips140: do not bloat crypto code unnecessarily

Updated September 28, 2026 · 1:27 AM · 33 · source date September 26, 2026

Summary

Golang: Crypto/fips140: do not bloat crypto code unnecessarily golang / go Public Notifications You must be signed in to change notification settings Fork 20.5k Star 139k proposal: crypto/fips140: do not bloat crypto code unnecessarily #81639 Copy link Copy link Open Open proposal: crypto/fips140: do not bloat crypto code unnecessarily #81639 Copy link Labels Proposal Proposal-Crypto Proposal related to crypto packages or other security issues Proposal related to crypto packages or other security issues Milestone Proposal Description zx2c4 opened on Sep 21, 2026 Issue body actions Abstract The FIPS140 code, especially its RNG, sits unused and bloaty on the overwhelming majority of Go binaries. All but the most specific users actually jump through the hoops of turning on this mostly useless (from a technical perspective) code.

Why it matters

This ProductUpdate is relevant to the technology intelligence record because it involves Google, GitHub, Meta. The source article should remain the factual reference for follow-up coverage.

Key facts

golang / go Public Notifications You must be signed in to change notification settings Fork 20.5k Star 139k proposal: crypto/fips140: do not bloat crypto code unnecessarily #81639 Copy link Copy link Open Open proposal: crypto/fips140: do not bloat crypto code unnecessarily #81639 Copy link Labels Proposal Proposal-Crypto Proposal related to crypto packages or other security issues Proposal related to crypto packages or other security issues Milestone Proposal Description zx2c4 opened on Sep 21, 2026 Issue body actions Abstract The FIPS140 code, especially its RNG, sits unused and bloaty on the overwhelming majority of Go binaries.
All but the most specific users actually jump through the hoops of turning on this mostly useless (from a technical perspective) code.
So it just sits there, wasting memory (the init functions still trigger) and wasting disk space and filling caches and just being a very unwelcome weight to a formerly clean set of crypto libraries.
This proposal is to add a new GOFIPS140=disabled default value to not compile in unused FIPS code.
Motivation The new fips140 code adds lots of indirection and gravely bloats the code size of resultant binaries, even when disabled or not in use.
Its use is gated by default-off GODEBUG flag.

Entities in this story

Companies

GitHub→ Google→ Meta→

Related events