Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.security > #4806 > unrolled thread
| Started by | Daniel Pocock <daniel@pocock.pro> |
|---|---|
| First post | 2016-05-18 15:30 +0200 |
| Last post | 2016-05-19 09:40 +0200 |
| Articles | 5 — 3 participants |
Back to article view | Back to linux.debian.security
Debian SHA-1 deprecation Daniel Pocock <daniel@pocock.pro> - 2016-05-18 15:30 +0200
Re: Debian SHA-1 deprecation Elmar Stellnberger <estellnb@gmail.com> - 2016-05-18 17:20 +0200
Re: Debian SHA-1 deprecation Paul Wise <pabs@debian.org> - 2016-05-19 03:30 +0200
Re: Debian SHA-1 deprecation Paul Wise <pabs@debian.org> - 2016-05-19 03:20 +0200
Re: Debian SHA-1 deprecation Daniel Pocock <daniel@pocock.pro> - 2016-05-19 09:40 +0200
| From | Daniel Pocock <daniel@pocock.pro> |
|---|---|
| Date | 2016-05-18 15:30 +0200 |
| Subject | Debian SHA-1 deprecation |
| Message-ID | <rA9HX-2GR-7@gated-at.bofh.it> |
Can anybody comment on how Debian users will be impacted by SHA-1 deprecation? In particular: - will libraries like OpenSSL and GnuTLS continue to support it in stretch and beyond? - will web servers like Apache support it in server certificates or certificate chains? - will web servers and other applications accept client certificates containing SHA-1 hashes? - if support for SHA-1 is being removed or disabled by default, will it also be disabled in security updates to jessie and wheezy LTS?
[toc] | [next] | [standalone]
| From | Elmar Stellnberger <estellnb@gmail.com> |
|---|---|
| Date | 2016-05-18 17:20 +0200 |
| Message-ID | <rAbqr-3On-61@gated-at.bofh.it> |
| In reply to | #4806 |
Am 2016-05-18 um 15:20 schrieb Daniel Pocock: > > > Can anybody comment on how Debian users will be impacted by SHA-1 > deprecation? > > In particular: > > - will libraries like OpenSSL and GnuTLS continue to support it in > stretch and beyond? > > - will web servers like Apache support it in server certificates or > certificate chains? > > - will web servers and other applications accept client certificates > containing SHA-1 hashes? > > - if support for SHA-1 is being removed or disabled by default, will it > also be disabled in security updates to jessie and wheezy LTS? > Besides these issues; has anyone ever thought of deprecating md5sum-s in package headers and using sha256sums instead? That would be of great help for tools like debsums or https://www.elstel.org/debcheckroot.
[toc] | [prev] | [next] | [standalone]
| From | Paul Wise <pabs@debian.org> |
|---|---|
| Date | 2016-05-19 03:30 +0200 |
| Message-ID | <rAkWJ-1pH-5@gated-at.bofh.it> |
| In reply to | #4808 |
On Wed, May 18, 2016 at 11:09 PM, Elmar Stellnberger wrote: > Besides these issues; has anyone ever thought of deprecating md5sum-s in > package headers and using sha256sums instead? That would be of great help > for tools like debsums or https://www.elstel.org/debcheckroot. AFAIK the md5sums in binary package files aren't intended to be a security feature. The package metadata already uses SHA-2. debcheckroot doesn't look like something that could ever do something useful, there are so many files in a Debian rootfs that are dynamically generated from package maintainer scripts rather shipping in the package itself. Run cruft-ng and you will see just how much. -- bye, pabs https://wiki.debian.org/PaulWise
[toc] | [prev] | [next] | [standalone]
| From | Paul Wise <pabs@debian.org> |
|---|---|
| Date | 2016-05-19 03:20 +0200 |
| Message-ID | <rAkN3-1lh-7@gated-at.bofh.it> |
| In reply to | #4806 |
On Wed, May 18, 2016 at 9:20 PM, Daniel Pocock wrote: > Can anybody comment on how Debian users will be impacted by SHA-1 > deprecation? There is some info related to that in these two wiki pages: https://wiki.debian.org/SHA-1 https://wiki.debian.org/Teams/Apt/Sha1Removal -- bye, pabs https://wiki.debian.org/PaulWise
[toc] | [prev] | [next] | [standalone]
| From | Daniel Pocock <daniel@pocock.pro> |
|---|---|
| Date | 2016-05-19 09:40 +0200 |
| Message-ID | <rAqIN-5bD-11@gated-at.bofh.it> |
| In reply to | #4816 |
On 19/05/16 03:17, Paul Wise wrote: > On Wed, May 18, 2016 at 9:20 PM, Daniel Pocock wrote: > >> Can anybody comment on how Debian users will be impacted by SHA-1 >> deprecation? > > There is some info related to that in these two wiki pages: > > https://wiki.debian.org/SHA-1 The way that page is structured today, it mixes things about how SHA-1 is used in Debian infrastructure (e.g. for the SPI CA) and how it is used in some of the software we distributed (e.g. in Git) Maybe we need to break it into separate sections: - SHA-1 in Debian infrastructure and workflows - SHA-1 in Debian packages Are there any useful discussions about the deprecation of MD-5 that we could link to, to give people an understanding of how things will change or how they should change? > https://wiki.debian.org/Teams/Apt/Sha1Removal >
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.security
csiph-web