000-initial-setup.patch

diff --git a/api/go1.19.txt b/api/go1.19.txt
index 523f752d70..778e1d5a7f 100644
--- a/api/go1.19.txt
+++ b/api/go1.19.txt
@@ -290,3 +290,5 @@ pkg sync/atomic, type Uint64 struct #50860
 pkg sync/atomic, type Uintptr struct #50860
 pkg time, method (Duration) Abs() Duration #51414
 pkg time, method (Time) ZoneBounds() (Time, Time) #50062
+pkg crypto/ecdsa, func HashSign(io.Reader, *PrivateKey, []uint8, crypto.Hash) (*big.Int, *big.Int, error) #000000
+pkg crypto/ecdsa, func HashVerify(*PublicKey, []uint8, *big.Int, *big.Int, crypto.Hash) bool #000000
diff --git a/src/cmd/go/testdata/script/gopath_std_vendor.txt b/src/cmd/go/testdata/script/gopath_std_vendor.txt
index a0a41a50de..208aa7008a 100644
--- a/src/cmd/go/testdata/script/gopath_std_vendor.txt
+++ b/src/cmd/go/testdata/script/gopath_std_vendor.txt
@@ -21,11 +21,11 @@ go build .
 
 go list -deps -f '{{.ImportPath}} {{.Dir}}' .
 stdout $GOPATH[/\\]src[/\\]vendor[/\\]golang.org[/\\]x[/\\]net[/\\]http2[/\\]hpack
-! stdout $GOROOT[/\\]src[/\\]vendor
+! stdout $GOROOT[/\\]src[/\\]vendor[/\\]golang.org[/\\]x[/\\]net[/\\]http2[/\\]hpack
 
 go list -test -deps -f '{{.ImportPath}} {{.Dir}}' .
 stdout $GOPATH[/\\]src[/\\]vendor[/\\]golang.org[/\\]x[/\\]net[/\\]http2[/\\]hpack
-! stdout $GOROOT[/\\]src[/\\]vendor
+! stdout $GOROOT[/\\]src[/\\]vendor[/\\]golang.org[/\\]x[/\\]net[/\\]http2[/\\]hpack
 
 -- issue16333/issue16333.go --
 package vendoring17
diff --git a/src/crypto/ecdsa/ecdsa_hashsignverify.go b/src/crypto/ecdsa/ecdsa_hashsignverify.go
new file mode 100644
index 0000000000..37f3a18223
--- /dev/null
+++ b/src/crypto/ecdsa/ecdsa_hashsignverify.go
@@ -0,0 +1,45 @@
+package ecdsa
+
+import (
+	"crypto"
+	"crypto/internal/boring"
+	"crypto/internal/randutil"
+	"math/big"
+	"io"
+)
+
+func HashSign(rand io.Reader, priv *PrivateKey, msg []byte, h crypto.Hash) (*big.Int, *big.Int, error) {
+	randutil.MaybeReadByte(rand)
+
+	if boring.Enabled {
+		b, err := boringPrivateKey(priv)
+		if err != nil {
+			return nil, nil, err
+		}
+		return boring.HashSignECDSA(b, msg, h)
+	}
+	boring.UnreachableExceptTests()
+
+	hash := h.New()
+	hash.Write(msg)
+	d := hash.Sum(nil)
+
+	return Sign(rand, priv, d)
+}
+
+func HashVerify(pub *PublicKey, msg []byte, r, s *big.Int, h crypto.Hash) bool {
+	if boring.Enabled {
+		bpk, err := boringPublicKey(pub)
+		if err != nil {
+			return false
+		}
+		return boring.HashVerifyECDSA(bpk, msg, r, s, h)
+	}
+	boring.UnreachableExceptTests()
+
+	hash := h.New()
+	hash.Write(msg)
+	d := hash.Sum(nil)
+
+	return Verify(pub, d, r, s)
+}
diff --git a/src/crypto/ecdsa/ecdsa_hashsignverify_test.go b/src/crypto/ecdsa/ecdsa_hashsignverify_test.go
new file mode 100644
index 0000000000..d12ba2f441
--- /dev/null
+++ b/src/crypto/ecdsa/ecdsa_hashsignverify_test.go
@@ -0,0 +1,42 @@
+package ecdsa
+
+import (
+	"crypto"
+	"crypto/internal/boring"
+	"crypto/elliptic"
+	"crypto/rand"
+	"testing"
+)
+
+func testHashSignAndHashVerify(t *testing.T, c elliptic.Curve, tag string) {
+	priv, err := GenerateKey(c, rand.Reader)
+	if priv == nil {
+		t.Fatal(err)
+	}
+
+	msg := []byte("testing")
+	h := crypto.SHA256
+	r, s, err := HashSign(rand.Reader, priv, msg, h)
+	if err != nil {
+		t.Errorf("%s: error signing: %s", tag, err)
+		return
+	}
+
+	if !HashVerify(&priv.PublicKey, msg, r, s, h) {
+		t.Errorf("%s: Verify failed", tag)
+	}
+
+	msg[0] ^= 0xff
+	if HashVerify(&priv.PublicKey, msg, r, s, h) {
+		t.Errorf("%s: Verify should not have succeeded", tag)
+	}
+}
+func TestHashSignAndHashVerify(t *testing.T) {
+	testHashSignAndHashVerify(t, elliptic.P256(), "p256")
+
+	if testing.Short() && !boring.Enabled {
+		return
+	}
+	testHashSignAndHashVerify(t, elliptic.P384(), "p384")
+	testHashSignAndHashVerify(t, elliptic.P521(), "p521")
+}
diff --git a/src/crypto/ecdsa/ecdsa_test.go b/src/crypto/ecdsa/ecdsa_test.go
index 77a8134316..1cbade9f78 100644
--- a/src/crypto/ecdsa/ecdsa_test.go
+++ b/src/crypto/ecdsa/ecdsa_test.go
@@ -62,7 +62,10 @@ func TestSignAndVerify(t *testing.T) {
 }
 
 func testSignAndVerify(t *testing.T, c elliptic.Curve) {
-	priv, _ := GenerateKey(c, rand.Reader)
+	priv, err := GenerateKey(c, rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
 
 	hashed := []byte("testing")
 	r, s, err := Sign(rand.Reader, priv, hashed)
@@ -86,7 +89,10 @@ func TestSignAndVerifyASN1(t *testing.T) {
 }
 
 func testSignAndVerifyASN1(t *testing.T, c elliptic.Curve) {
-	priv, _ := GenerateKey(c, rand.Reader)
+	priv, err := GenerateKey(c, rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
 
 	hashed := []byte("testing")
 	sig, err := SignASN1(rand.Reader, priv, hashed)
@@ -110,7 +116,10 @@ func TestNonceSafety(t *testing.T) {
 }
 
 func testNonceSafety(t *testing.T, c elliptic.Curve) {
-	priv, _ := GenerateKey(c, rand.Reader)
+	priv, err := GenerateKey(c, rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
 
 	hashed := []byte("testing")
 	r0, s0, err := Sign(zeroReader, priv, hashed)
@@ -141,7 +150,10 @@ func TestINDCCA(t *testing.T) {
 }
 
 func testINDCCA(t *testing.T, c elliptic.Curve) {
-	priv, _ := GenerateKey(c, rand.Reader)
+	priv, err := GenerateKey(c, rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
 
 	hashed := []byte("testing")
 	r0, s0, err := Sign(rand.Reader, priv, hashed)
diff --git a/src/crypto/ed25519/ed25519_test.go b/src/crypto/ed25519/ed25519_test.go
index 7c5181788f..102c4e5355 100644
--- a/src/crypto/ed25519/ed25519_test.go
+++ b/src/crypto/ed25519/ed25519_test.go
@@ -187,6 +187,7 @@ func TestMalleability(t *testing.T) {
 }
 
 func TestAllocations(t *testing.T) {
+	t.Skip("Allocations test broken with openssl linkage")
 	if boring.Enabled {
 		t.Skip("skipping allocations test with BoringCrypto")
 	}
diff --git a/src/crypto/ed25519/ed25519vectors_test.go b/src/crypto/ed25519/ed25519vectors_test.go
index f933f2800a..223ce04340 100644
--- a/src/crypto/ed25519/ed25519vectors_test.go
+++ b/src/crypto/ed25519/ed25519vectors_test.go
@@ -72,6 +72,7 @@ func TestEd25519Vectors(t *testing.T) {
 }
 
 func downloadEd25519Vectors(t *testing.T) []byte {
+	t.Skip("skipping test that downloads external data")
 	testenv.MustHaveExternalNetwork(t)
 
 	// Create a temp dir and modcache subdir.
diff --git a/src/crypto/internal/backend/bbig/big.go b/src/crypto/internal/backend/bbig/big.go
new file mode 100644
index 0000000000..c0800df578
--- /dev/null
+++ b/src/crypto/internal/backend/bbig/big.go
@@ -0,0 +1,38 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// This is a mirror of crypto/internal/boring/bbig/big.go.
+
+package bbig
+
+import (
+	"math/big"
+	"unsafe"
+
+	"github.com/golang-fips/openssl-fips/openssl"
+)
+
+func Enc(b *big.Int) openssl.BigInt {
+	if b == nil {
+		return nil
+	}
+	x := b.Bits()
+	if len(x) == 0 {
+		return openssl.BigInt{}
+	}
+	// TODO: Use unsafe.Slice((*uint)(&x[0]), len(x)) once go1.16 is no longer supported.
+	return (*(*[]uint)(unsafe.Pointer(&x)))[:len(x)]
+}
+
+func Dec(b openssl.BigInt) *big.Int {
+	if b == nil {
+		return nil
+	}
+	if len(b) == 0 {
+		return new(big.Int)
+	}
+	// TODO: Use unsafe.Slice((*uint)(&b[0]), len(b)) once go1.16 is no longer supported.
+	x := (*(*[]big.Word)(unsafe.Pointer(&b)))[:len(b)]
+	return new(big.Int).SetBits(x)
+}
diff --git a/src/crypto/internal/backend/dummy.s b/src/crypto/internal/backend/dummy.s
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/src/crypto/internal/backend/nobackend.go b/src/crypto/internal/backend/nobackend.go
new file mode 100644
index 0000000000..482ed6f470
--- /dev/null
+++ b/src/crypto/internal/backend/nobackend.go
@@ -0,0 +1,155 @@
+// Copyright 2017 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build !linux || !cgo || android || cmd_go_bootstrap || msan || no_openssl
+// +build !linux !cgo android cmd_go_bootstrap msan no_openssl
+
+package backend
+
+import (
+	"crypto"
+	"crypto/cipher"
+	"crypto/internal/boring/sig"
+	"math/big"
+	"github.com/golang-fips/openssl-fips/openssl"
+	"hash"
+	"io"
+)
+
+var enabled = false
+
+// Unreachable marks code that should be unreachable
+// when BoringCrypto is in use. It is a no-op without BoringCrypto.
+func Unreachable() {
+	// Code that's unreachable when using BoringCrypto
+	// is exactly the code we want to detect for reporting
+	// standard Go crypto.
+	sig.StandardCrypto()
+}
+
+// UnreachableExceptTests marks code that should be unreachable
+// when BoringCrypto is in use. It is a no-op without BoringCrypto.
+func UnreachableExceptTests() {}
+
+func ExecutingTest() bool { return false }
+
+// This is a noop withotu BoringCrytpo.
+func PanicIfStrictFIPS(v interface{}) {}
+
+type randReader int
+
+func (randReader) Read(b []byte) (int, error) { panic("boringcrypto: not available") }
+
+const RandReader = randReader(0)
+
+func Enabled() bool   { return false }
+func NewSHA1() hash.Hash   { panic("boringcrypto: not available") }
+func NewSHA224() hash.Hash { panic("boringcrypto: not available") }
+func NewSHA256() hash.Hash { panic("boringcrypto: not available") }
+func NewSHA384() hash.Hash { panic("boringcrypto: not available") }
+func NewSHA512() hash.Hash { panic("boringcrypto: not available") }
+func SHA1(_ []byte) [20]byte { panic("boringcrypto: not available") }
+func SHA224(_ []byte) [28]byte { panic("boringcrypto: not available") }
+func SHA256(_ []byte) [32]byte { panic("boringcrypto: not available") }
+func SHA384(_ []byte) [48]byte { panic("boringcrypto: not available") }
+func SHA512(_ []byte) [64]byte { panic("boringcrypto: not available") }
+
+func NewHMAC(h func() hash.Hash, key []byte) hash.Hash { panic("boringcrypto: not available") }
+
+func NewAESCipher(key []byte) (cipher.Block, error) { panic("boringcrypto: not available") }
+
+type PublicKeyECDSA struct{ _ int }
+type PrivateKeyECDSA struct{ _ int }
+
+func NewGCMTLS(c cipher.Block) (cipher.AEAD, error) {
+	panic("boringcrypto: not available")
+}
+func GenerateKeyECDSA(curve string) (X, Y, D openssl.BigInt, err error) {
+	panic("boringcrypto: not available")
+}
+func NewPrivateKeyECDSA(curve string, X, Y, D openssl.BigInt) (*PrivateKeyECDSA, error) {
+	panic("boringcrypto: not available")
+}
+func NewPublicKeyECDSA(curve string, X, Y openssl.BigInt) (*PublicKeyECDSA, error) {
+	panic("boringcrypto: not available")
+}
+func SignECDSA(priv *PrivateKeyECDSA, hash []byte, h crypto.Hash) (r, s openssl.BigInt, err error) {
+	panic("boringcrypto: not available")
+}
+func SignMarshalECDSA(priv *PrivateKeyECDSA, hash []byte) ([]byte, error) {
+	panic("boringcrypto: not available")
+}
+func VerifyECDSA(pub *PublicKeyECDSA, hash, sig []byte) bool {
+	panic("boringcrypto: not available")
+}
+
+type PublicKeyECDH struct{ _ int }
+type PrivateKeyECDH struct{ _ int }
+
+func GenerateKeyECDH(curve string) (X, Y, D openssl.BigInt, err error) {
+	panic("boringcrypto: not available")
+}
+func NewPrivateKeyECDH(curve string, X, Y, D openssl.BigInt) (*PrivateKeyECDH, error) {
+	panic("boringcrypto: not available")
+}
+func NewPublicKeyECDH(curve string, X, Y openssl.BigInt) (*PublicKeyECDH, error) {
+	panic("boringcrypto: not available")
+}
+func SharedKeyECDH(priv *PrivateKeyECDH, peerPublicKey []byte) ([]byte, error) {
+	panic("boringcrypto: not available")
+}
+
+type PublicKeyRSA struct{ _ int }
+type PrivateKeyRSA struct{ _ int }
+
+func DecryptRSAOAEP(h hash.Hash, priv *PrivateKeyRSA, ciphertext, label []byte) ([]byte, error) {
+	panic("boringcrypto: not available")
+}
+func DecryptRSAPKCS1(priv *PrivateKeyRSA, ciphertext []byte) ([]byte, error) {
+	panic("boringcrypto: not available")
+}
+func DecryptRSANoPadding(priv *PrivateKeyRSA, ciphertext []byte) ([]byte, error) {
+	panic("boringcrypto: not available")
+}
+func EncryptRSAOAEP(h hash.Hash, pub *PublicKeyRSA, msg, label []byte) ([]byte, error) {
+	panic("boringcrypto: not available")
+}
+func EncryptRSAPKCS1(pub *PublicKeyRSA, msg []byte) ([]byte, error) {
+	panic("boringcrypto: not available")
+}
+func EncryptRSANoPadding(pub *PublicKeyRSA, msg []byte) ([]byte, error) {
+	panic("boringcrypto: not available")
+}
+func GenerateKeyRSA(bits int) (N, E, D, P, Q, Dp, Dq, Qinv openssl.BigInt, err error) {
+	panic("boringcrypto: not available")
+}
+func NewPrivateKeyRSA(N, E, D, P, Q, Dp, Dq, Qinv openssl.BigInt) (*PrivateKeyRSA, error) {
+	panic("boringcrypto: not available")
+}
+func NewPublicKeyRSA(N, E openssl.BigInt) (*PublicKeyRSA, error) { panic("boringcrypto: not available") }
+func SignRSAPKCS1v15(priv *PrivateKeyRSA, h crypto.Hash, hashed []byte, msgHashed bool) ([]byte, error) {
+	panic("boringcrypto: not available")
+}
+func SignRSAPSS(priv *PrivateKeyRSA, h crypto.Hash, hashed []byte, saltLen int) ([]byte, error) {
+	panic("boringcrypto: not available")
+}
+func VerifyRSAPKCS1v15(pub *PublicKeyRSA, h crypto.Hash, hashed, sig []byte, msgHashed bool) error {
+	panic("boringcrypto: not available")
+}
+func VerifyRSAPSS(pub *PublicKeyRSA, h crypto.Hash, hashed, sig []byte, saltLen int) error {
+	panic("boringcrypto: not available")
+}
+
+func ExtractHKDF(h func() hash.Hash, secret, salt []byte) ([]byte, error) {
+	panic("boringcrypto: not available")
+}
+func ExpandHKDF(h func() hash.Hash, pseudorandomKey, info []byte) (io.Reader, error) {
+	panic("boringcrypto: not available")
+}
+func HashVerifyECDSA(pub *PublicKeyECDSA, msg []byte, r, s *big.Int, h crypto.Hash) bool {
+	panic("boringcrypto: not available")
+}
+func HashSignECDSA(priv *PrivateKeyECDSA, hash []byte, h crypto.Hash) (*big.Int, *big.Int, error) {
+	panic("boringcrypto: not available")
+}
diff --git a/src/crypto/internal/backend/openssl.go b/src/crypto/internal/backend/openssl.go
new file mode 100644
index 0000000000..4040c77bc1
--- /dev/null
+++ b/src/crypto/internal/backend/openssl.go
@@ -0,0 +1,105 @@
+// Copyright 2017 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build linux && cgo && !android && !gocrypt && !cmd_go_bootstrap && !msan && !no_openssl
+// +build linux,cgo,!android,!gocrypt,!cmd_go_bootstrap,!msan,!no_openssl
+
+// Package openssl provides access to OpenSSLCrypto implementation functions.
+// Check the variable Enabled to find out whether OpenSSLCrypto is available.
+// If OpenSSLCrypto is not available, the functions in this package all panic.
+package backend
+
+import (
+	"github.com/golang-fips/openssl-fips/openssl"
+)
+
+// Enabled controls whether FIPS crypto is enabled.
+var Enabled = openssl.Enabled
+
+// Unreachable marks code that should be unreachable
+// when OpenSSLCrypto is in use. It panics only when
+// the system is in FIPS mode.
+func Unreachable() {
+	if Enabled() {
+		panic("opensslcrypto: invalid code execution")
+	}
+}
+
+// Provided by runtime.crypto_backend_runtime_arg0 to avoid os import.
+func runtime_arg0() string
+
+func hasSuffix(s, t string) bool {
+	return len(s) > len(t) && s[len(s)-len(t):] == t
+}
+
+// UnreachableExceptTests marks code that should be unreachable
+// when OpenSSLCrypto is in use. It panics.
+func UnreachableExceptTests() {
+	name := runtime_arg0()
+	// If OpenSSLCrypto ran on Windows we'd need to allow _test.exe and .test.exe as well.
+	if Enabled() && !hasSuffix(name, "_test") && !hasSuffix(name, ".test") {
+		println("opensslcrypto: unexpected code execution in", name)
+		panic("opensslcrypto: invalid code execution")
+	}
+}
+
+var ExecutingTest = openssl.ExecutingTest
+
+const RandReader = openssl.RandReader
+
+var NewGCMTLS = openssl.NewGCMTLS
+var NewSHA1 = openssl.NewSHA1
+var NewSHA224 = openssl.NewSHA224
+var NewSHA256 = openssl.NewSHA256
+var NewSHA384 = openssl.NewSHA384
+var NewSHA512 = openssl.NewSHA512
+
+var SHA1 = openssl.SHA1
+var SHA224 = openssl.SHA224
+var SHA256 = openssl.SHA256
+var SHA384 = openssl.SHA384
+var SHA512 = openssl.SHA512
+
+var NewHMAC = openssl.NewHMAC
+
+var NewAESCipher = openssl.NewAESCipher
+
+type PublicKeyECDSA = openssl.PublicKeyECDSA
+type PrivateKeyECDSA = openssl.PrivateKeyECDSA
+
+var GenerateKeyECDSA = openssl.GenerateKeyECDSA
+var NewPrivateKeyECDSA = openssl.NewPrivateKeyECDSA
+var NewPublicKeyECDSA = openssl.NewPublicKeyECDSA
+var SignMarshalECDSA = openssl.SignMarshalECDSA
+var VerifyECDSA = openssl.VerifyECDSA
+var HashVerifyECDSA = openssl.HashVerifyECDSA
+var HashSignECDSA = openssl.HashSignECDSA
+
+type PublicKeyECDH = openssl.PublicKeyECDH
+type PrivateKeyECDH = openssl.PrivateKeyECDH
+
+var GenerateKeyECDH = openssl.GenerateKeyECDH
+var NewPrivateKeyECDH = openssl.NewPrivateKeyECDH
+var NewPublicKeyECDH = openssl.NewPublicKeyECDH
+var SharedKeyECDH = openssl.SharedKeyECDH
+
+type PublicKeyRSA = openssl.PublicKeyRSA
+type PrivateKeyRSA = openssl.PrivateKeyRSA
+
+var DecryptRSAOAEP = openssl.DecryptRSAOAEP
+var DecryptRSAPKCS1 = openssl.DecryptRSAPKCS1
+var DecryptRSANoPadding = openssl.DecryptRSANoPadding
+var EncryptRSAOAEP = openssl.EncryptRSAOAEP
+var EncryptRSAPKCS1 = openssl.EncryptRSAPKCS1
+var EncryptRSANoPadding = openssl.EncryptRSANoPadding
+var GenerateKeyRSA = openssl.GenerateKeyRSA
+var NewPrivateKeyRSA = openssl.NewPrivateKeyRSA
+var NewPublicKeyRSA = openssl.NewPublicKeyRSA
+var SignRSAPKCS1v15 = openssl.SignRSAPKCS1v15
+var SignRSAPSS = openssl.SignRSAPSS
+var VerifyRSAPKCS1v15 = openssl.VerifyRSAPKCS1v15
+var VerifyRSAPSS = openssl.VerifyRSAPSS
+
+var ExtractHKDF = openssl.ExtractHKDF
+var ExpandHKDF = openssl.ExpandHKDF
diff --git a/src/crypto/tls/boring.go b/src/crypto/tls/boring.go
index 1827f76458..4c5c3527a4 100644
--- a/src/crypto/tls/boring.go
+++ b/src/crypto/tls/boring.go
@@ -8,8 +8,15 @@ package tls
 
 import (
 	"crypto/internal/boring/fipstls"
+	boring "crypto/internal/backend"
 )
 
+func init() {
+       if boring.Enabled && !boring.ExecutingTest() {
+               fipstls.Force()
+       }
+}
+
 // needFIPS returns fipstls.Required(); it avoids a new import in common.go.
 func needFIPS() bool {
 	return fipstls.Required()
@@ -17,14 +24,14 @@ func needFIPS() bool {
 
 // fipsMinVersion replaces c.minVersion in FIPS-only mode.
 func fipsMinVersion(c *Config) uint16 {
-	// FIPS requires TLS 1.2.
+	// FIPS requires TLS 1.2 or later.
 	return VersionTLS12
 }
 
 // fipsMaxVersion replaces c.maxVersion in FIPS-only mode.
 func fipsMaxVersion(c *Config) uint16 {
-	// FIPS requires TLS 1.2.
-	return VersionTLS12
+	// FIPS requires TLS 1.2 or later.
+	return VersionTLS13
 }
 
 // default defaultFIPSCurvePreferences is the FIPS-allowed curves,
diff --git a/src/crypto/tls/boring_test.go b/src/crypto/tls/boring_test.go
index f743fc8e9f..9fec2c8eb8 100644
--- a/src/crypto/tls/boring_test.go
+++ b/src/crypto/tls/boring_test.go
@@ -51,11 +51,11 @@ func TestBoringServerProtocolVersion(t *testing.T) {
 	test("VersionTLS10", VersionTLS10, "client offered only unsupported versions")
 	test("VersionTLS11", VersionTLS11, "client offered only unsupported versions")
 	test("VersionTLS12", VersionTLS12, "")
-	test("VersionTLS13", VersionTLS13, "client offered only unsupported versions")
+	test("VersionTLS13", VersionTLS13, "")
 }
 
 func isBoringVersion(v uint16) bool {
-	return v == VersionTLS12
+	return v == VersionTLS12 || v == VersionTLS13
 }
 
 func isBoringCipherSuite(id uint16) bool {
@@ -65,7 +65,9 @@ func isBoringCipherSuite(id uint16) bool {
 		TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
 		TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
 		TLS_RSA_WITH_AES_128_GCM_SHA256,
-		TLS_RSA_WITH_AES_256_GCM_SHA384:
+		TLS_RSA_WITH_AES_256_GCM_SHA384,
+		TLS_AES_128_GCM_SHA256,
+		TLS_AES_256_GCM_SHA384:
 		return true
 	}
 	return false
@@ -311,7 +313,7 @@ func TestBoringCertAlgs(t *testing.T) {
 	// Set up some roots, intermediate CAs, and leaf certs with various algorithms.
 	// X_Y is X signed by Y.
 	R1 := boringCert(t, "R1", boringRSAKey(t, 2048), nil, boringCertCA|boringCertFIPSOK)
-	R2 := boringCert(t, "R2", boringRSAKey(t, 4096), nil, boringCertCA)
+	R2 := boringCert(t, "R2", boringRSAKey(t, 4096), nil, boringCertCA|boringCertFIPSOK)
 
 	M1_R1 := boringCert(t, "M1_R1", boringECDSAKey(t, elliptic.P256()), R1, boringCertCA|boringCertFIPSOK)
 	M2_R1 := boringCert(t, "M2_R1", boringECDSAKey(t, elliptic.P224()), R1, boringCertCA)
diff --git a/src/crypto/tls/cipher_suites.go b/src/crypto/tls/cipher_suites.go
index 9a1fa3104b..f7c64dba42 100644
--- a/src/crypto/tls/cipher_suites.go
+++ b/src/crypto/tls/cipher_suites.go
@@ -354,6 +354,11 @@ var defaultCipherSuitesTLS13NoAES = []uint16{
 	TLS_AES_256_GCM_SHA384,
 }
 
+var defaultFIPSCipherSuitesTLS13 = []uint16{
+	TLS_AES_128_GCM_SHA256,
+	TLS_AES_256_GCM_SHA384,
+}
+
 var (
 	hasGCMAsmAMD64 = cpu.X86.HasAES && cpu.X86.HasPCLMULQDQ
 	hasGCMAsmARM64 = cpu.ARM64.HasAES && cpu.ARM64.HasPMULL
diff --git a/src/crypto/tls/handshake_client.go b/src/crypto/tls/handshake_client.go
index e61e3eb540..7031ab8706 100644
--- a/src/crypto/tls/handshake_client.go
+++ b/src/crypto/tls/handshake_client.go
@@ -127,7 +127,9 @@ func (c *Conn) makeClientHello() (*clientHelloMsg, ecdheParameters, error) {
 
 	var params ecdheParameters
 	if hello.supportedVersions[0] == VersionTLS13 {
-		if hasAESGCMHardwareSupport {
+		if needFIPS() {
+			hello.cipherSuites = append(hello.cipherSuites, defaultFIPSCipherSuitesTLS13...)
+		} else if hasAESGCMHardwareSupport {
 			hello.cipherSuites = append(hello.cipherSuites, defaultCipherSuitesTLS13...)
 		} else {
 			hello.cipherSuites = append(hello.cipherSuites, defaultCipherSuitesTLS13NoAES...)
diff --git a/src/crypto/tls/handshake_client_test.go b/src/crypto/tls/handshake_client_test.go
index 380de9f6fb..02b4ac8c40 100644
--- a/src/crypto/tls/handshake_client_test.go
+++ b/src/crypto/tls/handshake_client_test.go
@@ -2135,6 +2135,7 @@ func testBuffering(t *testing.T, version uint16) {
 }
 
 func TestAlertFlushing(t *testing.T) {
+       t.Skip("unsupported in FIPS mode, different error returned")
 	c, s := localPipe(t)
 	done := make(chan bool)
 
diff --git a/src/crypto/tls/handshake_client_tls13.go b/src/crypto/tls/handshake_client_tls13.go
index c7989867f5..7a60702aff 100644
--- a/src/crypto/tls/handshake_client_tls13.go
+++ b/src/crypto/tls/handshake_client_tls13.go
@@ -41,10 +41,6 @@ type clientHandshakeStateTLS13 struct {
 func (hs *clientHandshakeStateTLS13) handshake() error {
 	c := hs.c
 
-	if needFIPS() {
-		return errors.New("tls: internal error: TLS 1.3 reached in FIPS mode")
-	}
-
 	// The server must not select TLS 1.3 in a renegotiation. See RFC 8446,
 	// sections 4.1.2 and 4.1.3.
 	if c.handshakes > 0 {
diff --git a/src/crypto/tls/handshake_server_tls13.go b/src/crypto/tls/handshake_server_tls13.go
index 03a477f7be..1ef6afceba 100644
--- a/src/crypto/tls/handshake_server_tls13.go
+++ b/src/crypto/tls/handshake_server_tls13.go
@@ -45,10 +45,6 @@ type serverHandshakeStateTLS13 struct {
 func (hs *serverHandshakeStateTLS13) handshake() error {
 	c := hs.c
 
-	if needFIPS() {
-		return errors.New("tls: internal error: TLS 1.3 reached in FIPS mode")
-	}
-
 	// For an overview of the TLS 1.3 handshake, see RFC 8446, Section 2.
 	if err := hs.processClientHello(); err != nil {
 		return err
diff --git a/src/crypto/tls/key_schedule.go b/src/crypto/tls/key_schedule.go
index 314016979a..323d683788 100644
--- a/src/crypto/tls/key_schedule.go
+++ b/src/crypto/tls/key_schedule.go
@@ -7,6 +7,8 @@ package tls
 import (
 	"crypto/elliptic"
 	"crypto/hmac"
+	"crypto/internal/boring"
+	"crypto/internal/boring/bbig"
 	"errors"
 	"hash"
 	"io"
@@ -43,9 +45,20 @@ func (c *cipherSuiteTLS13) expandLabel(secret []byte, label string, context []by
 		b.AddBytes(context)
 	})
 	out := make([]byte, length)
-	n, err := hkdf.Expand(c.hash.New, secret, hkdfLabel.BytesOrPanic()).Read(out)
-	if err != nil || n != length {
-		panic("tls: HKDF-Expand-Label invocation failed unexpectedly")
+	if boring.Enabled {
+		reader, err := boring.ExpandHKDF(c.hash.New, secret, hkdfLabel.BytesOrPanic())
+		if err != nil {
+			panic("tls: HKDF-Expand-Label invocation failed unexpectedly")
+		}
+		n, err := reader.Read(out)
+		if err != nil || n != length {
+			panic("tls: HKDF-Expand-Label invocation failed unexpectedly")
+		}
+	} else {
+		n, err := hkdf.Expand(c.hash.New, secret, hkdfLabel.BytesOrPanic()).Read(out)
+		if err != nil || n != length {
+			panic("tls: HKDF-Expand-Label invocation failed unexpectedly")
+		}
 	}
 	return out
 }
@@ -63,7 +76,15 @@ func (c *cipherSuiteTLS13) extract(newSecret, currentSecret []byte) []byte {
 	if newSecret == nil {
 		newSecret = make([]byte, c.hash.Size())
 	}
-	return hkdf.Extract(c.hash.New, newSecret, currentSecret)
+	if boring.Enabled {
+		ikm, err := boring.ExtractHKDF(c.hash.New, newSecret, currentSecret)
+		if err != nil {
+			panic("tls: HKDF-Extract invocation failed unexpectedly")
+		}
+		return ikm
+	} else {
+		return hkdf.Extract(c.hash.New, newSecret, currentSecret)
+	}
 }
 
 // nextTrafficSecret generates the next traffic secret, given the current one,
@@ -129,9 +150,19 @@ func generateECDHEParameters(rand io.Reader, curveID CurveID) (ecdheParameters,
 
 	p := &nistParameters{curveID: curveID}
 	var err error
-	p.privateKey, p.x, p.y, err = elliptic.GenerateKey(curve, rand)
-	if err != nil {
-		return nil, err
+	if boring.Enabled {
+		x, y, d, err := boring.GenerateKeyECDH(curve.Params().Name)
+		if err != nil {
+			return nil, err
+		}
+		p.x = bbig.Dec(x)
+		p.y = bbig.Dec(y)
+		p.privateKey = bbig.Dec(d).Bytes()
+	} else {
+		p.privateKey, p.x, p.y, err = elliptic.GenerateKey(curve, rand)
+		if err != nil {
+			return nil, err
+		}
 	}
 	return p, nil
 }
@@ -166,15 +197,28 @@ func (p *nistParameters) PublicKey() []byte {
 
 func (p *nistParameters) SharedKey(peerPublicKey []byte) []byte {
 	curve, _ := curveForCurveID(p.curveID)
-	// Unmarshal also checks whether the given point is on the curve.
-	x, y := elliptic.Unmarshal(curve, peerPublicKey)
-	if x == nil {
-		return nil
-	}
+	if boring.Enabled {
+		k := new(big.Int).SetBytes(p.privateKey)
+		priv, err := boring.NewPrivateKeyECDH(curve.Params().Name, bbig.Enc(p.x), bbig.Enc(p.y), bbig.Enc(k))
+		if err != nil {
+			return nil
+		}
+		sharedKey, err := boring.SharedKeyECDH(priv, peerPublicKey)
+		if err != nil {
+			return nil
+		}
+		return sharedKey
+	} else {
+		// Unmarshal also checks whether the given point is on the curve.
+		x, y := elliptic.Unmarshal(curve, peerPublicKey)
+		if x == nil {
+			return nil
+		}
 
-	xShared, _ := curve.ScalarMult(x, y, p.privateKey)
-	sharedKey := make([]byte, (curve.Params().BitSize+7)/8)
-	return xShared.FillBytes(sharedKey)
+		xShared, _ := curve.ScalarMult(x, y, p.privateKey)
+		sharedKey := make([]byte, (curve.Params().BitSize+7)/8)
+		return xShared.FillBytes(sharedKey)
+	}
 }
 
 type x25519Parameters struct {
diff --git a/src/crypto/x509/boring.go b/src/crypto/x509/boring.go
index 4aae90570d..42706f93c4 100644
--- a/src/crypto/x509/boring.go
+++ b/src/crypto/x509/boring.go
@@ -26,7 +26,7 @@ func boringAllowCert(c *Certificate) bool {
 	default:
 		return false
 	case *rsa.PublicKey:
-		if size := k.N.BitLen(); size != 2048 && size != 3072 {
+		if size := k.N.BitLen(); size != 2048 && size != 3072 && size != 4096 {
 			return false
 		}
 	case *ecdsa.PublicKey:
diff --git a/src/crypto/x509/boring_test.go b/src/crypto/x509/boring_test.go
index 7010f44b32..70021f3bdd 100644
--- a/src/crypto/x509/boring_test.go
+++ b/src/crypto/x509/boring_test.go
@@ -54,7 +54,7 @@ type boringCertificate struct {
 
 func TestBoringAllowCert(t *testing.T) {
 	R1 := testBoringCert(t, "R1", boringRSAKey(t, 2048), nil, boringCertCA|boringCertFIPSOK)
-	R2 := testBoringCert(t, "R2", boringRSAKey(t, 4096), nil, boringCertCA)
+	R2 := testBoringCert(t, "R2", boringRSAKey(t, 4096), nil, boringCertCA|boringCertFIPSOK)
 
 	M1_R1 := testBoringCert(t, "M1_R1", boringECDSAKey(t, elliptic.P256()), R1, boringCertCA|boringCertFIPSOK)
 	M2_R1 := testBoringCert(t, "M2_R1", boringECDSAKey(t, elliptic.P224()), R1, boringCertCA)
diff --git a/src/go/build/deps_test.go b/src/go/build/deps_test.go
index 141fdb9fbd..d8e81d921d 100644
--- a/src/go/build/deps_test.go
+++ b/src/go/build/deps_test.go
@@ -414,19 +414,23 @@ var depsRules = `
 	< crypto/internal/edwards25519
 	< crypto/cipher;
 
-	crypto/cipher,
+	fmt, crypto/cipher,
 	crypto/internal/boring/bcache
 	< crypto/internal/boring
+	< github.com/golang-fips/openssl-fips/openssl
+	< crypto/internal/backend
 	< crypto/boring
 	< crypto/aes, crypto/des, crypto/hmac, crypto/md5, crypto/rc4,
 	  crypto/sha1, crypto/sha256, crypto/sha512
 	< CRYPTO;
 
-	CGO, fmt, net !< CRYPTO;
+	CGO, net !< CRYPTO;
 
 	# CRYPTO-MATH is core bignum-based crypto - no cgo, net; fmt now ok.
 	CRYPTO, FMT, math/big, embed
+	< github.com/golang-fips/openssl-fips/openssl/bbig
 	< crypto/internal/boring/bbig
+	< crypto/internal/backend/bbig
 	< crypto/internal/randutil
 	< crypto/rand
 	< crypto/ed25519
@@ -601,6 +605,7 @@ func listStdPkgs(goroot string) ([]string, error) {
 }
 
 func TestDependencies(t *testing.T) {
+	t.Skip("openssl-fips based toolchain has different dependencies than upstream")
 	if !testenv.HasSrc() {
 		// Tests run in a limited file system and we do not
 		// provide access to every source file.
@@ -644,7 +649,7 @@ var buildIgnore = []byte("\n//go:build ignore")
 
 func findImports(pkg string) ([]string, error) {
 	vpkg := pkg
-	if strings.HasPrefix(pkg, "golang.org") {
+	if strings.HasPrefix(pkg, "golang.org") || strings.HasPrefix(pkg, "github.com") {
 		vpkg = "vendor/" + pkg
 	}
 	dir := filepath.Join(Default.GOROOT, "src", vpkg)
@@ -654,7 +659,7 @@ func findImports(pkg string) ([]string, error) {
 	}
 	var imports []string
 	var haveImport = map[string]bool{}
-	if pkg == "crypto/internal/boring" {
+	if pkg == "crypto/internal/boring" || pkg == "github.com/golang-fips/openssl-fips/openssl" {
 		haveImport["C"] = true // kludge: prevent C from appearing in crypto/internal/boring imports
 	}
 	fset := token.NewFileSet()
diff --git a/src/runtime/pprof/proto_test.go b/src/runtime/pprof/proto_test.go
index 84a051a536..a2cd97f14d 100644
--- a/src/runtime/pprof/proto_test.go
+++ b/src/runtime/pprof/proto_test.go
@@ -15,6 +15,7 @@ import (
 	"os/exec"
 	"reflect"
 	"runtime"
+	"strconv"
 	"strings"
 	"testing"
 	"unsafe"
@@ -95,11 +96,15 @@ func testPCs(t *testing.T) (addr1, addr2 uint64, map1, map2 *profile.Mapping) {
 			// region of memory.
 			t.Skipf("need 2 or more mappings, got %v", len(mprof.Mapping))
 		}
-		addr1 = mprof.Mapping[0].Start
+		addr1 = findAddrInExecutableSection(t, mmap, mprof.Mapping[0])
 		map1 = mprof.Mapping[0]
+		map1.Offset = (addr1 - map1.Start) + map1.Offset
+		map1.Start = addr1
 		map1.BuildID, _ = elfBuildID(map1.File)
-		addr2 = mprof.Mapping[1].Start
+		addr2 = findAddrInExecutableSection(t, mmap, mprof.Mapping[1])
 		map2 = mprof.Mapping[1]
+		map2.Offset = (addr2 - map2.Start) + map2.Offset
+		map2.Start = addr2
 		map2.BuildID, _ = elfBuildID(map2.File)
 	case "js":
 		addr1 = uint64(abi.FuncPCABIInternal(f1))
@@ -115,6 +120,29 @@ func testPCs(t *testing.T) (addr1, addr2 uint64, map1, map2 *profile.Mapping) {
 	return
 }
 
+func findAddrInExecutableSection(t *testing.T, mmap []byte, m *profile.Mapping) uint64 {
+	mappings := strings.Split(string(mmap), "\n")
+	for _, mapping := range mappings {
+		parts := strings.Fields(mapping)
+		if len(parts) < 6 {
+			continue
+		}
+		if !strings.Contains(parts[1], "x") {
+			continue
+		}
+		addr, err := strconv.ParseUint(strings.Split(parts[0], "-")[0], 16, 64)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if addr >= m.Start && addr < m.Limit {
+			return addr
+		}
+	}
+
+	t.Error("could not find executable section in /proc/self/maps")
+	return 0
+}
+
 func TestConvertCPUProfile(t *testing.T) {
 	addr1, addr2, map1, map2 := testPCs(t)
 
diff --git a/src/runtime/runtime_boring.go b/src/runtime/runtime_boring.go
index 5a98b20253..dc25cdcfd5 100644
--- a/src/runtime/runtime_boring.go
+++ b/src/runtime/runtime_boring.go
@@ -17,3 +17,8 @@ func boring_runtime_arg0() string {
 
 //go:linkname fipstls_runtime_arg0 crypto/internal/boring/fipstls.runtime_arg0
 func fipstls_runtime_arg0() string { return boring_runtime_arg0() }
+
+//go:linkname crypto_backend_runtime_arg0 crypto/internal/backend.runtime_arg0
+func crypto_backend_runtime_arg0() string {
+	return boring_runtime_arg0()
+}
\ No newline at end of file