Re: [Buildroot] [PATCH] package/dropbear: provide config option to turn off SHA1 for RSA

[Thomas Petazzoni via buildroot <buildroot@buildroot.org>]

Hello,

+Peter in Cc.

On Fri, 16 Aug 2024 17:00:26 -0700
Markus Mayer via buildroot <buildroot@buildroot.org> wrote:

> diff --git a/package/dropbear/Config.in b/package/dropbear/Config.in
> index 207c1f561700..099f61535aa2 100644
> --- a/package/dropbear/Config.in
> +++ b/package/dropbear/Config.in
> @@ -67,6 +67,12 @@ config BR2_PACKAGE_DROPBEAR_LEGACY_CRYPTO
>  	    DSA public keys
>  	    Diffie-Hellman Group1 key exchange
>  
> +config BR2_PACKAGE_DROPBEAR_DISABLE_RSA_SHA1
> +	bool "disable SHA1 hashing for RSA"
> +	help
> +	  SHA1 is no longer considered secure. Users may want to disable
> +	  it. However, this may preclude older clients from connecting.

Inverted logic options are always a bit annoying. Wouldn't it be better
to do:

config BR2_PACKAGE_DROPBEAR_RSA_SHA1
	bool "SHA1 hashing for RSA"
	default y
	help
	  SHA1 is no longer considered secure, so users may want to
	  disable it, but the lack of SHA1 support for RSA might
	  preclude older clients from connecting

	  This option defaults to enabled to preserve backward
	  compatibility.

Peter, what do you think? Or should we break backward compatibility for
the sake of security, and leave SHA1 support disabled by default?

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot