Boringcrypto/GO: FIPS wtih CBC

[Sammy_S]

Hi,

Looking at:

Making Go Program FIPS 140-2 Compliant with BoringCrypto

I’m working on making our company’s Go program, which relies on crypto/tls for HTTP-related purposes, FIPS 140-2 compliant. We are considering using BoringCrypto but I’d like to confirm a few observations and assumptions to ensure we’re on the right path. My understanding is that, starting with Go version 1.19, we can switch from the standard Go crypto package to BoringCrypto by setting the environment variables BUILD_GOEXPERIMENT=boringcrypto and BUILD_CGO_ENABLED=1 before running go build. I…

I have:
go version go1.25.5 darwin/amd64
I see in boringcrypto fips only mode, CBC is disabled.
Is there a way build boringcrypto in fips only mode with CBC enabled ?
Is it possible to pass cipher list (FIPS ciphers) to boringcrypto ?
Any pointers is highly appreciated.

Thanks !
S