openssl3

Author	SHA1	Message	Date
Clemens Lang	ede38fcb54	Prevent use of SHA1 with ECDSA providers/implementations/signature/{ec,}dsa_sig.c accept a NID_undef digest, so to prevent SHA1 from working with ECDSA and DSA, we must return a negative value in securitycheck.c. Resolves: rhbz#2031742	3 years ago
Clemens Lang	53f53fedec	Allow SHA1 usage in MGF1 for RSASSA-PSS signatures Resolves: rhbz#2031742 Signed-off-by: Clemens Lang <cllang@redhat.com>	3 years ago
Clemens Lang	5a9ab1160e	Allow SHA1 usage in HMAC in TLS The EVP_DigestSign API is used in TLS to compute a SHA1 HMAC, which is OK from our point of view, but was blocked so far. Modify 0049-Selectively-disallow-SHA1-signatures.patch to check the EVP_PKEY type for HMAC (and TLS1-PRF and HKDF), and allow SHA1 for these cases. Note that TLS1.1 signs a MD5-SHA1 hash with a private key, which does not work with rh-allow-sha1-signatures = no, so the minimum TLS version will be TLS 1.2. Resolves: rhbz#2031742 Signed-off-by: Clemens Lang <cllang@redhat.com>	3 years ago
Clemens Lang	78fb78d307	Disable SHA1 signature creation and verification by default Set rh-allow-sha1-signatures = yes to re-enable Resolves: rhbz#2031742 Signed-off-by: Clemens Lang <cllang@redhat.com>	3 years ago