Re: [Buildroot] [PATCH] package/dropbear: provide config option to turn off SHA1 for RSA

[Peter Korsgaard <peter@korsgaard.com>]

On 8/19/24 09:11, Peter Korsgaard wrote:

> True. It also somewhat depends on how fine grained configuration options
> we want, E.G. we could also simply handle the RSA_SHA1 option under the
> LEGACY_CRYPTO option WHEN upstream disables it by default, but then we
> have to wait for that.
> 
> Looking elsewhere, I see that openwrt handles it with a "modern only"
> option to only enable modern/secure options, maybe that is a way to go?
> 
> https://github.com/openwrt/openwrt/commit/bf900e02c7102601be2e9280231711e70f065877
> 
> Related to RSA_SHA1, I believe the original reason for you sending this
> patch was to disable everything related to SHA1, but SHA1 is also used
> for HMAC and key exchange, so we should consider disabling those as
> well:
> 
> https://github.com/openwrt/openwrt/commit/2d9a0be307b534ceb717267c95402d1d707cd2c3
> 
> What do you say?

This never made any progress, and I have in the mean time applied 
https://gitlab.com/buildroot.org/buildroot/-/commit/05fb4526f909aac533ed943977d4eeabd0b9b4ac, 
so now upstream has in fact disabled SHA1 support by default and we only 
enable it when the legacy crypto option is enabled, so I will mark this 
as superseeded.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot