Re: F41 Change Proposal: Make OpenSSL distrust SHA-1 signatures by default (system-wide)

Hello Daniel, > On 5. Jul 2024, at 15:33, Daniel P. Berrangé wrote: > > It isn't listed there, but it certainly should be, as we've not > been considering it FIPS compliant, for precisely this reason. OK. I’ve asked our docs team to add it to the list. Thank you for bringing this to my attenti

Re: F41 Change Proposal: Make OpenSSL distrust SHA-1 signatures by default (system-wide)

On Fri, Jul 05, 2024 at 02:59:36PM +0200, Clemens Lang wrote: > Hi, > > > On 5. Jul 2024, at 14:49, Daniel P. Berrangé wrote: > > > > On Fri, Jul 05, 2024 at 02:37:41PM +0200, Clemens Lang wrote: > >> > >> > >> Please start addressing this with whoever maintains the TPM specification. > > > >

Re: F41 Change Proposal: Make OpenSSL distrust SHA-1 signatures by default (system-wide)

Hi, > On 5. Jul 2024, at 14:49, Daniel P. Berrangé wrote: > > On Fri, Jul 05, 2024 at 02:37:41PM +0200, Clemens Lang wrote: >> >> >> Please start addressing this with whoever maintains the TPM specification. > > The TPM spec is maintained by the Trusted Computing Group, and I have > no influe

Re: F41 Change Proposal: Make OpenSSL distrust SHA-1 signatures by default (system-wide)

On Fri, Jul 05, 2024 at 02:37:41PM +0200, Clemens Lang wrote: > Hi, > > > On 5. Jul 2024, at 12:38, Daniel P. Berrangé wrote: > > > > I've (re-)discovered that this change is going to impact on swtpm that is > > used with QEMU to provide a virtual TPM to guests. > > > > The TPM2 specification h

Re: F41 Change Proposal: Make OpenSSL distrust SHA-1 signatures by default (system-wide)

Hi, > On 5. Jul 2024, at 12:38, Daniel P. Berrangé wrote: > > I've (re-)discovered that this change is going to impact on swtpm that is > used with QEMU to provide a virtual TPM to guests. > > The TPM2 specification has fully crypto agility, however, the sha1 > algorithm is one of the few that

Re: F41 Change Proposal: Make OpenSSL distrust SHA-1 signatures by default (system-wide)

On Mon, Jun 10, 2024 at 08:40:22PM +0200, Clemens Lang wrote: > Hi, > > > On 10. Jun 2024, at 20:16, Richard W.M. Jones wrote: > > > > On Mon, Jun 10, 2024 at 01:43:57PM +0200, Vít Ondruch wrote: > >> I wish this proposal included some examples of what might get broken > >> and what will keep wo

Re: F41 Change Proposal: Make OpenSSL distrust SHA-1 signatures by default (system-wide)

V Tue, Jun 11, 2024 at 04:09:54PM +0200, Dmitry Belyavskiy napsal(a): > I understand that not all old systems are upgradeable (though many of them > can be turned to smth using better algorithms - e.g. EC SSH keys are > available on RHEL 7). > So for these use cases we would like to propose either

Re: F41 Change Proposal: Make OpenSSL distrust SHA-1 signatures by default (system-wide)

Am 11.06.24 um 16:09 schrieb Dmitry Belyavskiy: Dear colleagues, Let me try to summarize the pros and cons of this discussion. Our intention is making the software and its settings as secure as possible by default. That's why we have crypto policies. The proposed change is aligned with the set

Re: F41 Change Proposal: Make OpenSSL distrust SHA-1 signatures by default (system-wide)

Dear colleagues, Let me try to summarize the pros and cons of this discussion. Our intention is making the software and its settings as secure as possible by default. That's why we have crypto policies. The proposed change is aligned with the setting we have implemented in RHEL9 for 2-3 years, an

Re: F41 Change Proposal: Make OpenSSL distrust SHA-1 signatures by default (system-wide)

Hi Peter, > On 11. Jun 2024, at 07:01, Peter Boy wrote: > >> Am 10.06.2024 um 20:16 schrieb Richard W.M. Jones : >> >> On Mon, Jun 10, 2024 at 01:43:57PM +0200, Vít Ondruch wrote: >>> I wish this proposal included some examples of what might get broken >>> and what will keep working. I guess I

Re: F41 Change Proposal: Make OpenSSL distrust SHA-1 signatures by default (system-wide)

> Am 10.06.2024 um 20:16 schrieb Richard W.M. Jones : > > On Mon, Jun 10, 2024 at 01:43:57PM +0200, Vít Ondruch wrote: >> I wish this proposal included some examples of what might get broken >> and what will keep working. I guess I am not the only one who have >> very vague understanding what is

Re: F41 Change Proposal: Make OpenSSL distrust SHA-1 signatures by default (system-wide)

Hi, > On 10. Jun 2024, at 20:16, Richard W.M. Jones wrote: > > On Mon, Jun 10, 2024 at 01:43:57PM +0200, Vít Ondruch wrote: >> I wish this proposal included some examples of what might get broken >> and what will keep working. I guess I am not the only one who have >> very vague understanding wh

Re: F41 Change Proposal: Make OpenSSL distrust SHA-1 signatures by default (system-wide)

08. 06. 24 v 0:43 Aoife Moloney napsal(a): > > >Wiki - https://fedoraproject.org/wiki/Changes/OpenSSLDistrustSHA1SigVer > > >Discussion Topic - > > >https://discussion.fedoraproject.org/t/f41-change-proposal-make-openssl-distrust-sha-1-signatures-by-default-system-wide/

Re: F41 Change Proposal: Make OpenSSL distrust SHA-1 signatures by default (system-wide)

Vít > > > Dne 08. 06. 24 v 0:43 Aoife Moloney napsal(a): > >Wiki - https://fedoraproject.org/wiki/Changes/OpenSSLDistrustSHA1SigVer > >Discussion Topic - > >https://discussion.fedoraproject.org/t/f41-change-proposal-make-openssl-distrust-sha-1-signatures-by-default-syste

Re: F41 Change Proposal: Make OpenSSL distrust SHA-1 signatures by default (system-wide)

ot; or other purposes SHA1 can be used for. > > > Vít > > > Dne 08. 06. 24 v 0:43 Aoife Moloney napsal(a): > > Wiki - Changes/OpenSSLDistrustSHA1SigVer - Fedora Project Wiki > > Discussion Topic - > > F41 Change Proposal: Make OpenSSL distrust SHA-1 signatures by default > &

Re: F41 Change Proposal: Make OpenSSL distrust SHA-1 signatures by default (system-wide)

ther purposes SHA1 can be used for. > > > Vít > > > Dne 08. 06. 24 v 0:43 Aoife Moloney napsal(a): > > Wiki - https://fedoraproject.org/wiki/Changes/OpenSSLDistrustSHA1SigVer > > Discussion Topic - > > https://discussion.fedoraproject.org/t/f41-change-proposal-make-openssl-dis

Re: F41 Change Proposal: Make OpenSSL distrust SHA-1 signatures by default (system-wide)

06. 24 v 0:43 Aoife Moloney napsal(a): Wiki - https://fedoraproject.org/wiki/Changes/OpenSSLDistrustSHA1SigVer Discussion Topic - https://discussion.fedoraproject.org/t/f41-change-proposal-make-openssl-distrust-sha-1-signatures-by-default-system-wide/119457 This is a proposed Change for Fedora

Re: F41 Change Proposal: Make OpenSSL distrust SHA-1 signatures by default (system-wide)

Hi Björn, > On 9. Jun 2024, at 00:37, Björn Persson wrote: > > Validating DNS resolvers are still required to be able to validate > signatures made with SHA-1. RFC 8624 is still current as far as I can > tell: > > https://www.rfc-editor.org/rfc/rfc8624#section-3.1 > https://www.rfc-editor.org/

Re: F41 Change Proposal: Make OpenSSL distrust SHA-1 signatures by default (system-wide)

Hi Vitaly, > On 9. Jun 2024, at 09:15, Vitaly Zaitsev via devel > wrote: > > On 08/06/2024 00:43, Aoife Moloney wrote: >> OpenSSL will no longer trust cryptographic signatures using SHA-1 by >> default, starting from Fedora 41. > > What about Git? AFAIK, AFAIK, Git heavily uses both SHA-1 and

Re: F41 Change Proposal: Make OpenSSL distrust SHA-1 signatures by default (system-wide)

Dear Roberto On Sun, Jun 9, 2024 at 1:16 PM Roberto Ragusa wrote: > On 6/9/24 11:27, Dmitry Belyavskiy wrote: > > > > On Sun, Jun 9, 2024 at 11:22 AM Zbigniew Jędrzejewski-Szmek < > zbys...@in.waw.pl > wrote: > > > > In https://fedoraproject.org/wiki/SHA1SignaturesG

Re: F41 Change Proposal: Make OpenSSL distrust SHA-1 signatures by default (system-wide)

On 6/9/24 11:27, Dmitry Belyavskiy wrote: On Sun, Jun 9, 2024 at 11:22 AM Zbigniew Jędrzejewski-Szmek mailto:zbys...@in.waw.pl>> wrote: In https://fedoraproject.org/wiki/SHA1SignaturesGuidance : > At the moment, we don't provide a

Re: F41 Change Proposal: Make OpenSSL distrust SHA-1 signatures by default (system-wide)

On Sun, Jun 9, 2024 at 11:22 AM Zbigniew Jędrzejewski-Szmek < zbys...@in.waw.pl> wrote: > In https://fedoraproject.org/wiki/SHA1SignaturesGuidance: > > At the moment, we don't provide a public API to enable SHA-1 signature > > support in OpenSSL programmatically. We ask you to respect the system >

Re: F41 Change Proposal: Make OpenSSL distrust SHA-1 signatures by default (system-wide)

Dear Björn, On Sun, Jun 9, 2024 at 12:39 AM Björn Persson wrote: > > == Summary == > > OpenSSL will no longer trust cryptographic signatures using SHA-1 by > > default, starting from Fedora 41. > > Validating DNS resolvers are still required to be able to validate > signatures made with SHA-1. R

Re: F41 Change Proposal: Make OpenSSL distrust SHA-1 signatures by default (system-wide)

In https://fedoraproject.org/wiki/SHA1SignaturesGuidance: > At the moment, we don't provide a public API to enable SHA-1 signature > support in OpenSSL programmatically. We ask you to respect the system > administrator's configuration choice on this. We're planning to work > with OpenSSL upstream t

Re: F41 Change Proposal: Make OpenSSL distrust SHA-1 signatures by default (system-wide)

Vitaly Zaitsev via devel wrote on Sun, Jun 09, 2024 at 09:15:56AM +0200: > On 08/06/2024 00:43, Aoife Moloney wrote: > > OpenSSL will no longer trust cryptographic signatures using SHA-1 by > > default, starting from Fedora 41. > > What about Git? AFAIK, AFAIK, Git heavily uses both SHA-1 and SHA-

Re: F41 Change Proposal: Make OpenSSL distrust SHA-1 signatures by default (system-wide)

On 08/06/2024 00:43, Aoife Moloney wrote: OpenSSL will no longer trust cryptographic signatures using SHA-1 by default, starting from Fedora 41. What about Git? AFAIK, AFAIK, Git heavily uses both SHA-1 and SHA-2 to validate objects and commits. -- Sincerely, Vitaly Zaitsev (vit...@easycod

Re: F41 Change Proposal: Make OpenSSL distrust SHA-1 signatures by default (system-wide)

> == Summary == > OpenSSL will no longer trust cryptographic signatures using SHA-1 by > default, starting from Fedora 41. Validating DNS resolvers are still required to be able to validate signatures made with SHA-1. RFC 8624 is still current as far as I can tell: https://www.rfc-editor.org/rfc/

F41 Change Proposal: Make OpenSSL distrust SHA-1 signatures by default (system-wide)

Wiki - https://fedoraproject.org/wiki/Changes/OpenSSLDistrustSHA1SigVer Discussion Topic - https://discussion.fedoraproject.org/t/f41-change-proposal-make-openssl-distrust-sha-1-signatures-by-default-system-wide/119457 This is a proposed Change for Fedora Linux. This document represents a