feat(crypto): FIPS 140-3 compliant build and runtime checks (#12233)

# Which Problems Are Solved

Enable FIPS 140-3 compliant build.

# How the Problems Are Solved

- Add runtime config validation, if the FIPS flag is enabled fail the
application when a non-compliant hasher is used, or throw a warning when
a legacy verifier is used
- Add a build matrix for FIPS certified build:
  - Go binary is built with `GOFIPS140=certified`
- Login container uses a separate base:
[ubi9](https://catalog.redhat.com/en/software/containers/ubi9/ubi/615bcf606feffc5384e8452e)
from redhat which provides a FIPS certified OpenSSL (used by NodeJS TLS
stack)
- Non-FIPS images where already pushed to both Github Container Registry
and Google Artifact Repository (GAR). Fips images are only pushed to the
GAR.
- Tag versions are suffixed `-fips`. So on release the following images
will be additionally available:

```
europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel-login:vX.Y.Z-fips
europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel:vX.Y.Z-fips-debug
europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel:vX.Y.Z-fips
```
  
# Other changes

- Bumb Go toolchain. At least v1.25.10 is required for a
GOFIPS140=certified setting.
 
# Additional Context

- Closes https://github.com/zitadel/zitadel/issues/4335
- Build [test
run](https://github.com/zitadel/zitadel/actions/runs/27253916052)
pushing FIPS and non-FIPS images

cmd/default_config_test.go

@@ -0,0 +1,75 @@
+package cmd
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/spf13/viper"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/zitadel/zitadel/internal/crypto"
+)
+
+func testViper(t *testing.T) *viper.Viper {
+	t.Helper()
+	v := viper.New()
+	v.SetConfigType("yaml")
+	return v
+}
+
+func loadAndUnmarshalHashConfig(t *testing.T, v *viper.Viper, key string) crypto.HashConfig {
+	t.Helper()
+	var cfg crypto.HashConfig
+	require.NoError(t, v.UnmarshalKey(key, &cfg))
+	return cfg
+}
+
+func loadBaseDefaultConfig(t *testing.T, v *viper.Viper) {
+	t.Helper()
+	require.NoError(t, v.ReadConfig(bytes.NewBuffer(defaultConfig)))
+}
+
+func TestLoadDefaultConfig_NonFIPSPasswordHasher(t *testing.T) {
+	v := testViper(t)
+	require.NoError(t, loadDefaultConfigInto(v))
+	cfg := loadAndUnmarshalHashConfig(t, v, "SystemDefaults.PasswordHasher")
+	assert.Equal(t, crypto.HashNameBcrypt, cfg.Hasher.Algorithm)
+}
+
+func TestLoadDefaultConfig_NonFIPSSecretHasher(t *testing.T) {
+	v := testViper(t)
+	require.NoError(t, loadDefaultConfigInto(v))
+	cfg := loadAndUnmarshalHashConfig(t, v, "SystemDefaults.SecretHasher")
+	assert.Equal(t, crypto.HashNameBcrypt, cfg.Hasher.Algorithm)
+}
+
+func TestLoadDefaultConfig_FIPSPasswordHasher(t *testing.T) {
+	v := testViper(t)
+	loadBaseDefaultConfig(t, v)
+	require.NoError(t, applyFipsDefaultOverlay(v))
+	cfg := loadAndUnmarshalHashConfig(t, v, "SystemDefaults.PasswordHasher")
+	assert.Equal(t, crypto.HashNamePBKDF2, cfg.Hasher.Algorithm)
+	assert.Equal(t, 290000, v.GetInt("SystemDefaults.PasswordHasher.Hasher.Rounds"))
+	assert.Equal(t, "sha256", v.GetString("SystemDefaults.PasswordHasher.Hasher.Hash"))
+	assert.Empty(t, cfg.Verifiers)
+}
+
+func TestLoadDefaultConfig_FIPSSecretHasher(t *testing.T) {
+	v := testViper(t)
+	loadBaseDefaultConfig(t, v)
+	require.NoError(t, applyFipsDefaultOverlay(v))
+	cfg := loadAndUnmarshalHashConfig(t, v, "SystemDefaults.SecretHasher")
+	assert.Equal(t, crypto.HashNamePBKDF2, cfg.Hasher.Algorithm)
+	assert.Equal(t, 290000, v.GetInt("SystemDefaults.SecretHasher.Hasher.Rounds"))
+	assert.Equal(t, "sha256", v.GetString("SystemDefaults.SecretHasher.Hasher.Hash"))
+	assert.Empty(t, cfg.Verifiers)
+}
+
+func TestLoadDefaultConfig_FIPSVerifierKeysEmpty(t *testing.T) {
+	v := testViper(t)
+	loadBaseDefaultConfig(t, v)
+	require.NoError(t, applyFipsDefaultOverlay(v))
+	assert.Empty(t, v.GetStringSlice("SystemDefaults.PasswordHasher.Verifiers"))
+	assert.Empty(t, v.GetStringSlice("SystemDefaults.SecretHasher.Verifiers"))
+}

cmd/defaults.yaml

@@ -890,6 +890,7 @@ SystemDefaults:
         MinP: 1 # ZITADEL_SYSTEMDEFAULTS_PASSWORDHASHER_LIMITS_SCRYPT_MINP
         MaxP: 16 # ZITADEL_SYSTEMDEFAULTS_PASSWORDHASHER_LIMITS_SCRYPT_MAXP
       PBKDF2:
+        # FIPS mode: MinRounds below 1000 (NIST SP 800-132) logs a startup warning; primary Hasher Rounds must be >= 1000.
         MinRounds: 1000 # ZITADEL_SYSTEMDEFAULTS_PASSWORDHASHER_LIMITS_PBKDF2_MINROUNDS
         MaxRounds: 10000000 # ZITADEL_SYSTEMDEFAULTS_PASSWORDHASHER_LIMITS_PBKDF2_MAXROUNDS
       Sha2:
@@ -966,6 +967,7 @@ SystemDefaults:
         MinP: 1 # ZITADEL_SYSTEMDEFAULTS_SECRETHASHER_LIMITS_SCRYPT_MINP
         MaxP: 16 # ZITADEL_SYSTEMDEFAULTS_SECRETHASHER_LIMITS_SCRYPT_MAXP
       PBKDF2:
+        # FIPS mode: MinRounds below 1000 (NIST SP 800-132) logs a startup warning; primary Hasher Rounds must be >= 1000.
         MinRounds: 1000 # ZITADEL_SYSTEMDEFAULTS_SECRETHASHER_LIMITS_PBKDF2_MINROUNDS
         MaxRounds: 10000000 # ZITADEL_SYSTEMDEFAULTS_SECRETHASHER_LIMITS_PBKDF2_MAXROUNDS
       Sha2:

cmd/defaults_fips.yaml

@@ -0,0 +1,14 @@
+# FIPS runtime overlay: merged on top of defaults.yaml when FIPS 140-3 mode is enabled (GODEBUG=fips140=on|only).
+SystemDefaults:
+  PasswordHasher:
+    Hasher:
+      Algorithm: pbkdf2 # ZITADEL_SYSTEMDEFAULTS_PASSWORDHASHER_HASHER_ALGORITHM
+      Rounds: 290000 # ZITADEL_SYSTEMDEFAULTS_PASSWORDHASHER_HASHER_ROUNDS
+      Hash: sha256 # ZITADEL_SYSTEMDEFAULTS_PASSWORDHASHER_HASHER_HASH
+    Verifiers: [] # ZITADEL_SYSTEMDEFAULTS_PASSWORDHASHER_VERIFIERS
+  SecretHasher:
+    Hasher:
+      Algorithm: pbkdf2 # ZITADEL_SYSTEMDEFAULTS_SECRETHASHER_HASHER_ALGORITHM
+      Rounds: 290000 # ZITADEL_SYSTEMDEFAULTS_SECRETHASHER_HASHER_ROUNDS
+      Hash: sha256 # ZITADEL_SYSTEMDEFAULTS_SECRETHASHER_HASHER_HASH
+    Verifiers: [] # ZITADEL_SYSTEMDEFAULTS_SECRETHASHER_VERIFIERS

cmd/zitadel.go

@@ -3,6 +3,7 @@ package cmd
 import (
 	"bytes"
 	"context"
+	"crypto/fips140"
 	_ "embed"
 	"errors"
 	"io"
@@ -27,6 +28,9 @@ var (
 
 	//go:embed defaults.yaml
 	defaultConfig []byte
+
+	//go:embed defaults_fips.yaml
+	defaultFipsConfig []byte
 )
 
 func New(out io.Writer, in io.Reader, args []string, server chan<- *start.Server) *cobra.Command {
@@ -45,7 +49,7 @@ func New(out io.Writer, in io.Reader, args []string, server chan<- *start.Server
 	viper.SetEnvPrefix("ZITADEL")
 	viper.SetEnvKeyReplacer(strings.NewReplacer(".", "_"))
 	viper.SetConfigType("yaml")
-	err := viper.ReadConfig(bytes.NewBuffer(defaultConfig))
+	err := loadDefaultConfig()
 	logging.OnError(context.Background(), err).Fatal("unable to read default config")
 
 	cobra.OnInitialize(initConfig)
@@ -68,6 +72,28 @@ func New(out io.Writer, in io.Reader, args []string, server chan<- *start.Server
 	return cmd
 }
 
+func loadDefaultConfig() error {
+	return loadDefaultConfigInto(viper.GetViper())
+}
+
+func loadDefaultConfigInto(v *viper.Viper) error {
+	if err := v.ReadConfig(bytes.NewBuffer(defaultConfig)); err != nil {
+		return err
+	}
+	return mergeFipsDefaultConfig(v)
+}
+
+func mergeFipsDefaultConfig(v *viper.Viper) error {
+	if !fips140.Enabled() {
+		return nil
+	}
+	return applyFipsDefaultOverlay(v)
+}
+
+func applyFipsDefaultOverlay(v *viper.Viper) error {
+	return v.MergeConfig(bytes.NewBuffer(defaultFipsConfig))
+}
+
 func initConfig() {
 	for _, file := range configFiles {
 		viper.SetConfigFile(file)