Do not allow 64 bit ciphers for encryption without explicit option. #2266
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #2266 +/- ##
==========================================
+ Coverage 84.80% 84.81% +0.01%
==========================================
Files 116 116
Lines 23280 23346 +66
==========================================
+ Hits 19743 19802 +59
- Misses 3537 3544 +7 ☔ View full report in Codecov by Sentry. |
desvxx
force-pushed
the
desvxx-1598-prohibit-old-64bit-ciphers
branch
from
32242b1 to
8eaebd4
Compare
desvxx
changed the title
desvxx
force-pushed
the
desvxx-1598-prohibit-old-64bit-ciphers
branch
3 times, most recently
from
b469fa4 to
4c9fee3
Compare
|
@desvxx linter failed. |
desvxx
force-pushed
the
desvxx-1598-prohibit-old-64bit-ciphers
branch
7 times, most recently
from
480d3d7 to
135db4a
Compare
desvxx
force-pushed
the
desvxx-1598-prohibit-old-64bit-ciphers
branch
from
135db4a to
0c01729
Compare
desvxx
force-pushed
the
desvxx-1598-prohibit-old-64bit-ciphers
branch
from
0c01729 to
68f103b
Compare
desvxx
commented
Nov 24, 2024
src/lib/sec_profile.cpp
Outdated
| @@ -196,6 +196,13 @@ SecurityContext::SecurityContext() : time_(0), prov_state_(NULL), rng(RNG::Type: | |||
| SecurityAction::VerifyKey}); | |||
| /* Mark MD5 insecure since 2012-01-01 */ | |||
| profile.add_rule({FeatureType::Hash, PGP_HASH_MD5, SecurityLevel::Insecure, 1325376000}); | |||
| /* Mark CAST5, 3DES, IDEA, BLOWFISH insecure since 2024-10-01*/ // TODO: tbd | |||
There was a problem hiding this comment.
And also we need to decide what date we want here.
There was a problem hiding this comment.
@desvxx As there is no reason to use cut-off date much older than release, and no sense to make it in future, let's use the one you typed in, just please remove the TODO item.
desvxx
force-pushed
the
desvxx-1598-prohibit-old-64bit-ciphers
branch
from
68f103b to
3867501
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
fixes #1598