fix(tls): Remove post-quantum algorithms from FIPS

sfleen · sfleen · commit c921c7050b78 · 2025-08-21T10:43:45.000-04:00
This removes `SECP256R1MLKEM768` as a supported algorithm when FIPS mode is enabled in the proxy.

Signed-off-by: Scott Fleener &lt;scott@buoyant.io&gt;
diff --git a/linkerd/rustls/src/crypto.rs b/linkerd/rustls/src/crypto.rs
@@ -46,7 +46,6 @@ fn kx_groups() -> Vec<&'static dyn SupportedKxGroup> {
 #[cfg(feature = "rustls-aws-lc-fips")]
 fn kx_groups() -> Vec<&'static dyn SupportedKxGroup> {
     vec![
-        aws_lc_rs::kx_group::SECP256R1MLKEM768,
         aws_lc_rs::kx_group::SECP256R1,
         aws_lc_rs::kx_group::SECP384R1,
     ]

Original file line number	Diff line number	Diff line change
`@@ -46,7 +46,6 @@ fn kx_groups() -> Vec<&'static dyn SupportedKxGroup> {`
`46`	`46`	`#[cfg(feature = "rustls-aws-lc-fips")]`
`47`	`47`	`fn kx_groups() -> Vec<&'static dyn SupportedKxGroup> {`
`48`	`48`	`vec![`
`49`		`- aws_lc_rs::kx_group::SECP256R1MLKEM768,`
`50`	`49`	`aws_lc_rs::kx_group::SECP256R1,`
`51`	`50`	`aws_lc_rs::kx_group::SECP384R1,`
`52`	`51`	`]`