feat(fips): update keystore to use crypto/pbkdf2 in go 1.24 (#289)

* feat(fips): update keystore to use crypto/pbkdf2 in go 1.24

the keystore is not used in fips mode but importing the pkg is
causing x/crypto to be linked in the final binary.
We can't drop go 1.23 so just add build tags to use stdlib
crypto/pbkdf2 if the app is on go 1.24 (which is required for
fips anyway).

* Update pbkdf2_legacy.go

Author: kruskall

keystore/file_keystore.go

@@ -22,7 +22,6 @@ import (
 	"crypto/aes"
 	"crypto/cipher"
 	"crypto/rand"
-	"crypto/sha512"
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
@@ -32,8 +31,6 @@ import (
 	"runtime"
 	"sync"
 
-	"golang.org/x/crypto/pbkdf2"
-
 	"github.com/elastic/elastic-agent-libs/config"
 	"github.com/elastic/elastic-agent-libs/file"
 )
@@ -342,7 +339,10 @@ func (k *FileKeystore) encrypt(reader io.Reader) (io.Reader, error) {
 
 	// Stretch the user provided key
 	password, _ := k.password.Get()
-	passwordBytes := k.hashPassword(password, salt)
+	passwordBytes, err := k.hashPassword(string(password), salt)
+	if err != nil {
+		return nil, fmt.Errorf("could not hash password, error: %w", err)
+	}
 
 	// Select AES-256: because len(passwordBytes) == 32 bytes
 	block, err := aes.NewCipher(passwordBytes)
@@ -388,7 +388,10 @@ func (k *FileKeystore) decrypt(reader io.Reader) (io.Reader, error) {
 	encodedBytes := data[saltLength+iVLength:]
 
 	password, _ := k.password.Get()
-	passwordBytes := k.hashPassword(password, salt)
+	passwordBytes, err := k.hashPassword(string(password), salt)
+	if err != nil {
+		return nil, fmt.Errorf("could not hash password, error: %w", err)
+	}
 
 	block, err := aes.NewCipher(passwordBytes)
 	if err != nil {
@@ -456,10 +459,6 @@ func (k *FileKeystore) ConfiguredPath() string {
 	return k.Path
 }
 
-func (k *FileKeystore) hashPassword(password, salt []byte) []byte {
-	return pbkdf2.Key(password, salt, iterationsCount, keyLength, sha512.New)
-}
-
 // randomBytes return a slice of random bytes of the defined length
 func randomBytes(length int) ([]byte, error) {
 	r := make([]byte, length)

keystore/pbkdf2_go124.go

@@ -0,0 +1,29 @@
+// Licensed to Elasticsearch B.V. under one or more contributor
+// license agreements. See the NOTICE file distributed with
+// this work for additional information regarding copyright
+// ownership. Elasticsearch B.V. licenses this file to you under
+// the Apache License, Version 2.0 (the "License"); you may
+// not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+//go:build go1.24
+
+package keystore
+
+import (
+	"crypto/pbkdf2"
+	"crypto/sha512"
+)
+
+func (k *FileKeystore) hashPassword(password string, salt []byte) ([]byte, error) {
+	return pbkdf2.Key(sha512.New, password, salt, iterationsCount, keyLength)
+}

keystore/pbkdf2_legacy.go

@@ -0,0 +1,30 @@
+// Licensed to Elasticsearch B.V. under one or more contributor
+// license agreements. See the NOTICE file distributed with
+// this work for additional information regarding copyright
+// ownership. Elasticsearch B.V. licenses this file to you under
+// the Apache License, Version 2.0 (the "License"); you may
+// not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+//go:build !go1.24
+
+package keystore
+
+import (
+	"crypto/sha512"
+
+	"golang.org/x/crypto/pbkdf2"
+)
+
+func (k *FileKeystore) hashPassword(password string, salt []byte) ([]byte, error) {
+	return pbkdf2.Key([]byte(password), salt, iterationsCount, keyLength, sha512.New), nil
+}