TGPSKI FIPS Remediation Plan
Generate component-specific remediation TODO lists from FIPS crypto audit results, with effort estimates and PR sequencing.
This is a directed workflow following the Inspect-Decide-Generate pattern.
When to Use
- After running
@fips-crypto-audit/SKILL.mdand getting results - When a component team asks "what do I need to fix?"
- When planning sprint work for FIPS migration
- When generating PR descriptions for remediation work
Inspect
1. Find audit results
ls -lt results/summary-*.txt | head -3
If no results exist, tell the user to run @fips-crypto-audit/SKILL.md first.
2. Read the summary
Read the most recent summary file to understand the scope.
3. Determine target
Ask the user:
| Question | Default |
|---|---|
| Which component(s)? | All with CRITICAL or WARNING findings |
| Include vendor findings? | First-party only (vendor needs upstream PRs) |
| Output format? | Markdown TODO list |
Decide
For each component, read its detail file and classify every first-party finding:
| Finding Class | Status | Action |
|---|---|---|
| CRITICAL first-party, actual crypto | must-fix |
Replace algorithm or remove feature |
| CRITICAL first-party, non-crypto | swap |
Replace with hash/fnv, hash/crc32, or crypto/sha256 |
| WARNING first-party, test code | low-priority |
Fix in test refactor |
| WARNING first-party, production | should-fix |
Swap algorithm |
| AUDIT first-party, SHA-256/AES/RSA>=2048 | no-change |
Already FIPS-approved |
| AUDIT first-party, crypto/rand | no-change |
Legitimate crypto RNG |
| Vendor CRITICAL, org-owned | upstream-pr |
File PR against shared library |
| Vendor CRITICAL, external | track |
File issue, track upstream |
Generate
For each component with findings, produce:
## <component-name> FIPS Remediation
### Must Fix (blocks fips140=only)
- [ ] `path/to/file.go:42` — md5.New() for password hashing
- **Why**: Actual cryptographic use of non-FIPS algorithm
- **Fix**: Replace with bcrypt or SHA-256 based password hash
- **Effort**: S (< 1 hour)
- **PR**: Standalone PR, no dependencies
### Swap (non-crypto usage of crypto primitives)
- [ ] `path/to/file.go:88` — md5.New() for content fingerprinting
- **Why**: Non-cryptographic use, will fail under fips140=only
- **Fix**: Replace with `hash/fnv` or `crypto/sha256` (already FIPS-approved)
- **Effort**: XS (< 15 min)
### No Change Needed
- `path/to/file.go:120` — sha256.Sum256() for config annotation hash
- SHA-256 is FIPS-approved. No action required.
### Upstream Dependencies
- [ ] <shared-library> — <description of finding>
- **Track**: [link to issue/PR if exists]
- **After fix**: Run `go get` + `go mod vendor` to pull fix
PR Sequencing
Generate a suggested PR order:
| Order | PR | Components | Depends On |
|---|---|---|---|
| 1 | Shared library: swap non-FIPS hash to SHA-256 | All consumers | Nothing |
| 2 | Service with actual FIPS violation | That service | Nothing |
| 3 | Service with non-crypto MD5 usage | That service | Nothing |
| N | Vendor bumps across all consumers | All | PR #1 merged |
Effort Summary
For each component, produce a one-line effort estimate:
<service-a>: 1 must-fix, 1 swap → ~2 hours
<service-b>: 2 swap → ~30 min
<service-c>: 1 swap → ~15 min
All others: vendor bumps only → ~15 min each after upstream PRs merge
Follow-up Skills
- Use
@fips-finding-triage/SKILL.mdto investigate ambiguous findings before classifying - Use
@fips-crypto-audit/SKILL.mdto re-audit after fixes are applied