Bug 1960700
| Summary: | update LEGACY policy for OpenSSL to SECLEVEL1 from SECLEVE2 | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | Sahana Prasad <sahana> | ||||
| Component: | crypto-policies | Assignee: | Alexander Sosedkin <asosedki> | ||||
| Status: | CLOSED NOTABUG | QA Contact: | BaseOS QE Security Team <qe-baseos-security> | ||||
| Severity: | unspecified | Docs Contact: | |||||
| Priority: | medium | ||||||
| Version: | 9.0 | CC: | asosedki, bstinson, hkario, jwboyer, pvrabec | ||||
| Target Milestone: | beta | Keywords: | Triaged | ||||
| Target Release: | --- | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2021-12-13 12:50:57 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | 1959016 | ||||||
| Bug Blocks: | |||||||
| Attachments: |
|
||||||
Infinite customisability to pick and choose supported signature algorithms and key sizes is not something upstream supports, so this is rather unavoidable. For people that have no choice but to go lower there's opting out of crypto-policies and SECLEVEL=0. We have decided to no longer modify the SECLEVELS in OpenSSL. Instead we will implement a new config option that allows SHA-1 signatures. Therefore this change in CP is not required. |
Created attachment 1784008 [details] Proposed patch Well, this is doable, of course. The downside is that, by tying SHA-1 to SECLEVEL, we'll lose the ability to go lower than what SECLEVEL=1 offers, even with custom policies. See the proposed patch, do you have any better suggestions?