diff options
author | Kurt Roeckx <kurt@roeckx.be> | 2020-01-02 23:25:27 +0100 |
---|---|---|
committer | Kurt Roeckx <kurt@roeckx.be> | 2020-02-05 22:07:38 +0100 |
commit | 68436f0a8964e911eb4f864bc8b31d7ca4d29585 (patch) | |
tree | cfe4c18cfcb43ea754c04962df50c1994949ce94 /crypto/x509/x509_set.c | |
parent | b98efebeb2d4265bd6638d5947fe365500121e03 (diff) |
Stop accepting certificates signed using SHA1 at security level 1
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
GH: #10786
(cherry picked from commit b744f915ca8bb37631909728dd2529289bda8438)
Diffstat (limited to 'crypto/x509/x509_set.c')
-rw-r--r-- | crypto/x509/x509_set.c | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/crypto/x509/x509_set.c b/crypto/x509/x509_set.c index 164b4e2be1..deb7722c18 100644 --- a/crypto/x509/x509_set.c +++ b/crypto/x509/x509_set.c @@ -222,6 +222,20 @@ static void x509_sig_info_init(X509_SIG_INFO *siginf, const X509_ALGOR *alg, return; /* Security bits: half number of bits in digest */ siginf->secbits = EVP_MD_size(md) * 4; + /* + * SHA1 and MD5 are known to be broken. Reduce security bits so that + * they're no longer accepted at security level 1. The real values don't + * really matter as long as they're lower than 80, which is our security + * level 1. + * https://eprint.iacr.org/2020/014 puts a chosen-prefix attack for SHA1 at + * 2^63.4 + * https://documents.epfl.ch/users/l/le/lenstra/public/papers/lat.pdf + * puts a chosen-prefix attack for MD5 at 2^39. + */ + if (mdnid == NID_sha1) + siginf->secbits = 63; + else if (mdnid == NID_md5) + siginf->secbits = 39; switch (mdnid) { case NID_sha1: case NID_sha256: |