The crypto/boring package currently just exports func Enabled() bool. I propose to add an additional function:

// FIPS reports whether BoringCrypto is FIPS-enabled.
func FIPS() bool

When GOEXPERIMENT=boringcrypto is set, boring.FIPS() would always return true, as BoringCrypto is static-linked and its binary is owned by the Go toolchain, so we know for sure that it is FIPS-enabled.

The new function would mainly benefit Go forks that provide FIPS support using libraries whose FIPS status can only be known at runtime, e.g. dynamic-linking against OpenSSL or Windows CNG.

One could argue that Go forks can add whatever API they wish, including the one here proposed, but trying to keep source compatibility with upstream Go benefits the whole community. IMO, this particular function is generic enough to deserve a place in crypto/boring. Would have been nice to have a more generic name for this package, but that's not something that worries me that much for now.

Disclaimer: I'm asking this as a maintainer of the Microsoft Go fork, but this API has been requested to us by a fork of our fork: microsoft/go#999. This proposal contains the following use-cases to support adding FIPS() bool:

• Surfacing FIPS mode status to the user through the application's API (docker info)
• Telemetry / analytics - how many customers use FIPS mode
• Altering the application behaviour when FIPS mode is enabled - both to switch to using only FIPS-approved algorithms and to change some user-facing behaviours

@rsc