php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #66833 Default disgest algo is still MD5
Submitted: 2014-03-06 11:42 UTC Modified: -
From: remi@php.net Assigned:
Status: Closed Package: OpenSSL related
PHP Version: 5.4.25 OS: GNU/LInux
Private report: No CVE-ID: None
View Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
If you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: remi@php.net
New email:
PHP Version: OS:

 

 [2014-03-06 11:42 UTC] remi@php.net 
Description:
------------
Default disgest  algo is still MD5, which means we can generate digest which are rejected on some recent openssl version (at least RHEL-7 and Fedora 21).

Proposal: switch to sha256 (sha1 is also now considered as unsecure)

Patches

openssl-defaultmd-sha1.patch (last revision 2014-03-06 12:24 UTC by remi@php.net)
openssl-defaultmd.patch (last revision 2014-03-06 11:42 UTC by remi)

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2014-03-06 11:43 UTC] remi@php.net 
This change will allow to revert workaround added in
http://git.php.net/?p=php-src.git;a=commitdiff;h=721b9a7c8dbe52cd3f0d2ac69b8eb9c78a0721c9
 [2014-03-06 11:49 UTC] remi@php.net 
To be considered: there are still widely used legacy applications that cannot verify signatures that use sha256.
 [2014-03-06 12:24 UTC] remi@php.net 
The following patch has been added/updated:

Patch Name: openssl-defaultmd-sha1.patch
Revision:   1394108650
URL:        https://bugs.php.net/patch-display.php?bug=66833&patch=openssl-defaultmd-sha1.patch&revision=1394108650
 [2014-03-06 12:53 UTC] remi@php.net 
After a deeper analysis:

Most PHP users will rely on system configuration (so sha1 or sha256 on modern distro)

So this only affects user which use a non-default configuration, without default_md option (as in the ext/openssl/tests/bug36732.phpt test).

So switch to EVP_sha1() seems the simple solution, less risky, and will match recent openssl library hardcoded value (sha256 is only set in the provided configuration).
 [2014-03-14 08:53 UTC] remi@php.net 
Automatic comment on behalf of remi
Revision: http://git.php.net/?p=php-src.git;a=commit;h=17f6391bf8bc5e0e74ea981c795455a18826ed35
Log: Fixed Bug #66833 Default digest algo is still MD5
 [2014-03-14 08:53 UTC] remi@php.net
-Status: Open +Status: Closed
 [2014-03-14 11:26 UTC] ab@php.net 
Automatic comment on behalf of remi
Revision: http://git.php.net/?p=php-src.git;a=commit;h=17f6391bf8bc5e0e74ea981c795455a18826ed35
Log: Fixed Bug #66833 Default digest algo is still MD5
 [2014-03-14 11:35 UTC] ab@php.net 
Automatic comment on behalf of remi
Revision: http://git.php.net/?p=php-src.git;a=commit;h=17f6391bf8bc5e0e74ea981c795455a18826ed35
Log: Fixed Bug #66833 Default digest algo is still MD5
 [2014-04-10 04:47 UTC] tyrael@php.net 
Automatic comment on behalf of remi
Revision: http://git.php.net/?p=php-src.git;a=commit;h=17f6391bf8bc5e0e74ea981c795455a18826ed35
Log: Fixed Bug #66833 Default digest algo is still MD5
 [2014-10-07 23:15 UTC] stas@php.net 
Automatic comment on behalf of remi
Revision: http://git.php.net/?p=php-src-security.git;a=commit;h=17f6391bf8bc5e0e74ea981c795455a18826ed35
Log: Fixed Bug #66833 Default digest algo is still MD5
 [2014-10-07 23:27 UTC] stas@php.net 
Automatic comment on behalf of remi
Revision: http://git.php.net/?p=php-src-security.git;a=commit;h=17f6391bf8bc5e0e74ea981c795455a18826ed35
Log: Fixed Bug #66833 Default digest algo is still MD5
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Sat Nov 23 07:01:29 2024 UTC