add FIPSApproved and FipsCBC functions (#141)

Author: gdams

cng/aes.go

@@ -91,10 +91,18 @@ func (c *aesCipher) NewCBCEncrypter(iv []byte) cipher.BlockMode {
 	return newCBC(true, bcrypt.AES_ALGORITHM, c.key, iv)
 }
 
+func (c *aesCipher) NewFIPSCBCEncrypter(iv []byte) cipher.BlockMode {
+	return newCBC(true, bcrypt.AES_ALGORITHM, c.key, iv)
+}
+
 func (c *aesCipher) NewCBCDecrypter(iv []byte) cipher.BlockMode {
 	return newCBC(false, bcrypt.AES_ALGORITHM, c.key, iv)
 }
 
+func (c *aesCipher) NewFIPSCBCDecrypter(iv []byte) cipher.BlockMode {
+	return newCBC(false, bcrypt.AES_ALGORITHM, c.key, iv)
+}
+
 type noGCM struct {
 	cipher.Block
 }

cng/hash.go

@@ -160,6 +160,17 @@ func hashToID(h hash.Hash) string {
 var _ hash.Hash = (*Hash)(nil)
 var _ HashCloner = (*Hash)(nil)
 
+// FIPSApproved reports whether this hash algorithm is FIPS 140-3 approved.
+func (h *Hash) FIPSApproved() bool {
+	switch h.alg.id {
+	case bcrypt.SHA256_ALGORITHM, bcrypt.SHA384_ALGORITHM, bcrypt.SHA512_ALGORITHM,
+		bcrypt.SHA3_256_ALGORITHM, bcrypt.SHA3_384_ALGORITHM, bcrypt.SHA3_512_ALGORITHM:
+		return true
+	default:
+		return false
+	}
+}
+
 // Hash implements [hash.Hash].
 type Hash struct {
 	alg *hashAlgorithm