## Summary Request for LabKit to consider providing standardized, FIPS-compliant encryption primitives for Go services. This would give GitLab Go services a single abstraction for column-level encryption, key management, and credential protection — with guaranteed FIPS compliance. ## Context During discussions in [gitlab-org/ops/artifact-registry#68](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/68) and [gitlab-org/distribution/team-tasks#1706](https://gitlab.com/gitlab-org/distribution/team-tasks/-/work_items/1706), the Artifact Registry team identified a need for column-level encryption of registry credentials (`encrypted_password`, `encrypted_auth_token`, `encrypted_username`). The team evaluated [tink-go](https://github.com/tink-crypto/tink-go) but found it currently incompatible with Go's FIPS 140-3 enforcement mode ([tink-go#28](https://github.com/tink-crypto/tink-go/issues/28)). Go's stdlib now has a FIPS 140-3 validated cryptographic module ([CMVP #5247](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5247), active through 2031). The leaning consensus across teams (AR, Security) is that this logic is too sensitive to implement independently in every modular Go service. Every Go service with encrypted DB columns will face the same problem. ## What LabKit could provide - **`KeyProvider` abstraction**: pluggable key encryption key (KEK) backends covering local secrets, GCP KMS, AWS KMS, Azure Key Vault, PKCS#11 (hardware HSMs), and Vault Transit - **Key rotation**: zero-downtime rotation with key versioning - **FIPS-compliant API**: built on Go's stdlib `cipher.NewGCMWithRandomNonce` (CMVP 5247), ensuring all crypto operations run inside the validated FIPS module boundary - **Column-level encryption patterns**: envelope encryption with per-row data encryption keys (DEKs) ## Related issues - [gitlab-org/ops/artifact-registry#68](https://gitlab.com/gitlab-org/ops/artifact-registry/-/work_items/68) — Original column-level encryption discussion and evaluation - https://gitlab.com/gitlab-org/distribution/team-tasks/-/work_items/1706+ — Go FIPS module discussion - [tink-go#28](https://github.com/tink-crypto/tink-go/issues/28) — Tink-Go FIPS incompatibility /cc @WarheadsSE @suleimiahmed @jdrpereira