SNOW-3927213 [fips-crypto]: Route WIF SigV4 and first-party SHA-256 through AWS-LC

sf_core/CHANGELOG.md

@@ -47,6 +47,7 @@ New features:
 
 Changes:
 
+- Routed first-party SHA-256 hashing for CRL cache filenames, token-cache keys, S3 credential fingerprints, and certificate-name map keys through AWS-LC instead of a direct `sha2` dependency; their stored key formats remain unchanged. (snowflakedb/drivers#1352)
 - Improved GCS PUT throughput by streaming each file in one request instead of sending sequential chunks. (snowflakedb/drivers#2267)
 - Changed `connection_is_usable` to report a connection as terminated once the server has said this session cannot be recovered (GS 390111 gone or 390117 closed, on a query, heartbeat, or token-request RENEW). Other RENEW refusals, and a renewal that fails to reach the server, leave the connection alone. The background heartbeat task stops rather than beating such a session. The error each operation returns is unchanged. (snowflakedb/drivers#2149)
 - Improved first-connection latency on non-FIPS builds by dropping AWS-LC's CPU jitter entropy source from cold start. (snowflakedb/drivers#2108)

sf_core/Cargo.toml

@@ -269,8 +269,6 @@ zeroize = "1.8"
 hex = "0.4"
 memchr = "2"
 sonic-rs = { version = "0.5", optional = true }
-sha2 = "0.10"
-hmac = "0.12"
 clap = { version = "4.5", features = ["derive", "env"], optional = true }
 signature = "2"
 der = "0.7"

sf_core/src/crl/cache.rs

@@ -6,13 +6,13 @@ use crate::crl::error::{
 };
 use crate::http::retry::{HttpContext, HttpError, execute_bytes_with_retry_capped};
 use crate::utils::sync::MutexRecoverExt;
+use aws_lc_rs::digest;
 use chrono::{DateTime, Utc};
 use fs2::FileExt;
 use once_cell::sync::OnceCell;
 use opentelemetry::metrics::{Counter, Histogram, Meter};
 use opentelemetry::{KeyValue, global};
 use reqwest::Method;
-use sha2::{Digest, Sha256};
 use snafu::ResultExt;
 use std::collections::HashMap;
 use std::io::Write;
@@ -931,10 +931,7 @@ impl CrlCache {
     }
 
     pub fn url_digest(url: &str) -> String {
-        let mut hasher = Sha256::new();
-        hasher.update(url.as_bytes());
-        let digest = hasher.finalize();
-        hex::encode(digest)
+        hex::encode(digest::digest(&digest::SHA256, url.as_bytes()).as_ref())
     }
 
     #[cfg(test)]
@@ -1446,6 +1443,14 @@ mod tests {
     use tokio::runtime::Builder;
     use tokio::time::timeout;
 
+    #[test]
+    fn url_digest_preserves_disk_cache_filename() {
+        assert_eq!(
+            CrlCache::url_digest("https://example.com/foo.crl"),
+            "68ca88702d45a2e76f4994133f55d850551fe8f064465e97cef9b390620003a9"
+        );
+    }
+
     fn test_config() -> CrlConfig {
         CrlConfig {
             enable_memory_caching: true,

sf_core/src/file_manager/s3_transfer.rs

@@ -27,6 +27,7 @@ use tokio_stream::wrappers::ReceiverStream;
 // AWS SDK imports
 use aws_config::{BehaviorVersion, Region, SdkConfig};
 use aws_credential_types::Credentials;
+use aws_lc_rs::digest;
 use aws_sdk_s3::config::RequestChecksumCalculation;
 use aws_sdk_s3::config::retry::RetryConfig as AwsRetryConfig;
 use aws_sdk_s3::config::timeout::TimeoutConfig as AwsTimeoutConfig;
@@ -35,7 +36,6 @@ use aws_sdk_s3::types::BucketAccelerateStatus;
 use aws_sdk_s3::types::{CompletedMultipartUpload, CompletedPart};
 use aws_sdk_s3::{Client as S3Client, primitives::ByteStream};
 use aws_smithy_types::body::SdkBody;
-use sha2::{Digest, Sha256};
 
 const SNOWFLAKE_UPLOAD_PROVIDER: &str = "snowflake-upload";
 const SNOWFLAKE_DOWNLOAD_PROVIDER: &str = "snowflake-download";
@@ -1927,7 +1927,9 @@ fn s3_creds_fingerprint(creds: &CloudCredentials) -> Option<String> {
                 .map(|t| t.reveal().as_str())
                 .unwrap_or("");
             let material = format!("{}:{token}", aws_key_id.reveal());
-            Some(hex::encode(Sha256::digest(material.as_bytes())))
+            Some(hex::encode(
+                digest::digest(&digest::SHA256, material.as_bytes()).as_ref(),
+            ))
         }
         _ => None,
     }
@@ -2693,6 +2695,14 @@ mod tests {
         }
     }
 
+    #[test]
+    fn s3_creds_fingerprint_preserves_sts_cache_key() {
+        assert_eq!(
+            s3_creds_fingerprint(&s3_creds("AKIA1")).as_deref(),
+            Some("3d34dfe320119e79244eae97a751d802ceaf9e7992e2fc24bcd0c2f974727fcd")
+        );
+    }
+
     // --- aws_key_id helper used by S3StsRefresher's rotation check ---
     //
     // S3StsRefresher compares AWS key ids before/after refresh: a different

sf_core/src/rest/snowflake/oauth/pkce.rs

@@ -39,8 +39,8 @@ pub(crate) fn generate() -> PkceMaterial {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use aws_lc_rs::digest;
     use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
-    use sha2::{Digest, Sha256};
 
     #[test]
     fn generated_verifier_is_at_least_43_chars() {
@@ -96,10 +96,8 @@ mod tests {
     #[test]
     fn challenge_equals_b64url_sha256_of_verifier() {
         let m = generate();
-        let mut hasher = Sha256::new();
-        hasher.update(m.verifier.reveal().as_bytes());
-        let digest = hasher.finalize();
-        let expected = URL_SAFE_NO_PAD.encode(digest);
+        let digest = digest::digest(&digest::SHA256, m.verifier.reveal().as_bytes());
+        let expected = URL_SAFE_NO_PAD.encode(digest.as_ref());
         assert_eq!(m.challenge, expected);
     }
 }