Fernet support was added to SwarmKit to provide a FIPS-compatible alternative to NaCl secretbox. Since then, Go has gained native FIPS 140 support for standard-library cryptographic primitives, making alternatives such as AES-GCM practical without relying on Fernet.
The fernet-go module also appears lightly maintained and has no tagged releases, leaving consumers pinned to pseudo-versions.
We should investigate:
- using a stdlib AEAD, likely AES-GCM, for newly written encrypted raft records;
- whether the existing FIPS/non-FIPS write-format split can be removed;
- retaining Fernet decryption, and probably the
fernet-go dependency initially, for existing raft state, backups, and migration compatibility.
This would not initially remove Fernet support entirely; it would only stop creating new Fernet-encrypted records once compatibility and mixed-version upgrade behavior have been addressed.
Fernet support was added to SwarmKit to provide a FIPS-compatible alternative to NaCl
secretbox. Since then, Go has gained native FIPS 140 support for standard-library cryptographic primitives, making alternatives such as AES-GCM practical without relying on Fernet.The
fernet-gomodule also appears lightly maintained and has no tagged releases, leaving consumers pinned to pseudo-versions.We should investigate:
fernet-godependency initially, for existing raft state, backups, and migration compatibility.This would not initially remove Fernet support entirely; it would only stop creating new Fernet-encrypted records once compatibility and mixed-version upgrade behavior have been addressed.