Adding a config option in openssl.cnf to enable SHA-1 signature creation and verification
#17.662 aperta il 8 feb 2022
Metriche repository
- Star
- (30.157 stelle)
- Metriche merge PR
- (Nessuna PR mergiata in 30 g)
Descrizione
At Red Hat, we set the SECLEVEL to 2 in DEFAULT and LEGACY policies (in crypto-policies [1], not providers). So when SECLEVEL 2 is in use, the creation and verification of SHA-1 signatures is rejected as insecure as expected. But to be backwards compatible with systems that would migrate to OpenSSL 3.0.0 and still use SHA-1 (only for signatures), we thought of providing a config option such as allow-SHA-1-signatures, to be configured in the alg_section of openssl.cnf. When this option is set to True, we would then allow the creation and verification of SHA-1 signatures.
Would upstream be interested or do you see any value addition with this config option? Or would you have any other ideas as to how we could enable this on a need basis?
(We understand that the workaround would be to just switch to SECLEVEL 0 in such cases, but that doesn't work for us unfortunately)