> ## Documentation Index
> Fetch the complete documentation index at: https://docs.formal.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# FIPS

> Deploy the FIPS build of the Formal Connector and understand its cryptographic and feature restrictions

The FIPS Connector is a separate build of the Formal Connector for environments that require FIPS 140-3.
It uses the Go Cryptographic Module and limits the Connector to approved cryptography.

<Warning>
  Using this image does not make an entire deployment FIPS compliant. You must
  confirm that your operating environment and configuration meet your compliance
  requirements.
</Warning>

## Pull the image

The FIPS image uses a separate `formalco-prod-connector-fips` repository.
Use the same release tag across either registry.

| Registry              | Image                                                                                                    |
| --------------------- | -------------------------------------------------------------------------------------------------------- |
| AWS ECR               | `654654333078.dkr.ecr.<region>.amazonaws.com/formalco-prod-connector-fips:<tag>`                         |
| GCP Artifact Registry | `us-docker.pkg.dev/formal-public-assets/formalco-prod-connector-fips/formalco-prod-connector-fips:<tag>` |

ECR images are available in `us-east-1`, `us-west-1`, and `us-west-2`.
Both registries also publish a `latest` tag.

For example, pull a versioned image from GCP Artifact Registry:

```bash theme={null}
docker pull us-docker.pkg.dev/formal-public-assets/formalco-prod-connector-fips/formalco-prod-connector-fips:<tag>
```

Use versioned tags in production so deployments remain reproducible.

## Go Cryptographic Module

Formal does not maintain a separate validated cryptographic module.
The FIPS Connector builds against the Go Cryptographic Module `v1.26.0`, frozen from Go 1.26, in FIPS 140-3 mode.

In this mode, the Go module performs integrity checks and cryptographic self-tests.
It uses a NIST SP 800-90A deterministic random bit generator.
Go TLS also rejects protocol versions, cipher suites, signatures, and key exchanges that are not approved.
Required key consistency tests can make some key generation operations slower.
The image also directs AWS SDK calls to AWS FIPS service endpoints.

The Go project lists `v1.26.0` as pending CMVP review and covered by
[CAVP certificate A8028](https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program/details?validation=40638).
See the [Go FIPS 140-3 documentation](https://go.dev/doc/security/fips140)
for its current CMVP status, tested operating environments, and security policy.

## Restrictions

The FIPS build removes features that depend on code outside the Go Cryptographic Module.
It also rejects protocol options that require unapproved cryptography.

| Area                             | Restriction                                                                       | Supported alternative                                                   |
| -------------------------------- | --------------------------------------------------------------------------------- | ----------------------------------------------------------------------- |
| Policy hooks                     | Hooks are unavailable.                                                            | Express the required behavior in policy without hooks.                  |
| RDP                              | RDP proxying is unavailable.                                                      | Use a standard Connector build for RDP resources.                       |
| MySQL and MariaDB                | Client and upstream connections must use TLS. Plaintext connections are rejected. | Configure TLS on both sides of the Connector.                           |
| MySQL and MariaDB authentication | `mysql_native_password` is unavailable.                                           | Use `caching_sha2_password` over TLS.                                   |
| PostgreSQL authentication        | MD5 password authentication is unavailable.                                       | Use SCRAM-SHA-256.                                                      |
| MongoDB authentication           | SCRAM-SHA-1 is unavailable.                                                       | Use SCRAM-SHA-256.                                                      |
| TLS                              | Go rejects non-approved choices, including ChaCha20-Poly1305 cipher suites.       | Use an approved TLS configuration, such as TLS 1.2 or 1.3 with AES-GCM. |
| S3 checksums                     | `Content-MD5` and SHA-1 checksums are unavailable.                                | Use SHA-256, CRC32, CRC32C, or CRC64NVME checksums.                     |
| SSH                              | SHA-1 `ssh-rsa` signatures are unavailable. An upstream host key must be pinned.  | Use RSA-SHA2 or another approved signature with a pinned host key.      |
| Resource TLS verification        | `insecure-skip-verify` and `insecure-verify-ca-only` are unavailable.             | Use full certificate and hostname verification.                         |

Review these restrictions before replacing a standard Connector image.
Existing resource or policy settings can prevent the FIPS Connector from starting or serving a connection.