Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:96744
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain kelunik.com from 81.169.146.219 cause and error)
MIME-Version: 1.0
In-Reply-To: <CAEKnhAF-qbiaHNzenf4STYuNhde7Deep=MQB0SsnEX78QKv8og@mail.gmail.com>
References: <CAKws9z2C9cPYRWP4gAP=JiHEq2bDZT3z9v7JFRWnZiKg-QZH0Q@mail.gmail.com>
 <CAEKnhAF-qbiaHNzenf4STYuNhde7Deep=MQB0SsnEX78QKv8og@mail.gmail.com>
Date: Sun, 6 Nov 2016 20:34:11 +0100
Message-ID: <CANUQDCgMhLC7p=-YZ2zU5aX1Z3HuH_SGd+unbMHh==A5ntKLtw@mail.gmail.com>
To: Jakub Zelenka <bukka@php.net>
Cc: Scott Arciszewski <scott@paragonie.com>, PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=047d7b86ead4e049ec0540a6fd75
Subject: Re: [PHP-DEV] OpenSSL - New Defaults
From: me@kelunik.com (Niklas Keller)

--047d7b86ead4e049ec0540a6fd75
Content-Type: text/plain; charset=UTF-8

2016-11-06 20:19 GMT+01:00 Jakub Zelenka <bukka@php.net>:

> Hi,
>
> On Thu, Nov 3, 2016 at 4:11 PM, Scott Arciszewski <scott@paragonie.com>
> wrote:
>
> > Hi,
> >
> > Can we change openssl_public_encrypt() and openssl_private_decrypt() from
> > defaulting to PKCS1v1.5 padding, in favor of defaulting to OAEP?
> >
> > I'll create an RFC for this later. It will just prevent a lot of issues.
> >
> > To wit:
> >
> > - https://framework.zend.com/security/advisory/ZF2015-10
> > -
> > https://github.com/garyr/portunus/blob/89853c180c85c71baac7015cb77ff8
> > ddae129942/src/Portunus/Crypt/RSA/PrivateKey.php#L20
> > -
> > https://github.com/NorseBlue/Sikker/blob/c158bab1e676d751e5228cb17ecf95
> > 93c6b94e95/src/Asymmetric/Keys/PrivateKey.php#L72
> >
> > If we can't stop PHP developers who aren't cryptographers from writing
> > their own high-level RSA implementation, we can at least make it safer by
> > default.
> >
> >
> We can't change default in 7.x as it would be a BC break and in this case a
> very hard to catch BC break as the only way how we could let user know
> about that is a documentation. This is a very low level function and
> PKCSv1.5 is still used a lot so some apps might depend on. I think that the
> default is bad but I don't think that breaking both function without notice
> is a good solution as users might not be able to catch it especially if
> it's some third party protocol that is not very secure but you don't have
> choice because 3rd party won't change it (that was actually the only case
> where I used these functions in practice so it's not made up). And even
> worse if you don't have tests, then it breaks just production without a
> warning...
>
> What I would prefer instead is to deprecate calling
> openssl_(private|public)_(en|de)crypt without a padding parameter. The
> default would stay the same but user would get a deprecation message and
> the parameter would become required in PHP 8. We should add a note to the
> doc, to let the user know what the safest option is. It means OAEP
> for openssl_private_decrypt and openssl_public_encrypt. In case of
> openssl_public_decrypt and openssl_private_encrypt, we support just
> PKCS1v1.5 but if we add support for PSS (would require a little bit of
> tweaking as it works on EVP level only but might add it later), we could
> easily recommend it then.
>
> I have got actually very similar plan for openssl_seal and openssl_open
> that have default method rc4. Again very bad default but the best way how
> to let user know is to deprecate it rather than choose new default and
> break compatibility.
>
> Cheers
>
> Jakub
>

Huge +1 for that plan!

Regards, Niklas

--047d7b86ead4e049ec0540a6fd75--