Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:99227
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain kelunik.com from 81.169.146.217 cause and error)
MIME-Version: 1.0
In-Reply-To: <CANUQDCiUYNwH_tkZyS_cbWVa1X=4CAA3_14VD+fYjAXk-JU=1g@mail.gmail.com>
References: <CANUQDCiUYNwH_tkZyS_cbWVa1X=4CAA3_14VD+fYjAXk-JU=1g@mail.gmail.com>
Date: Mon, 29 May 2017 12:58:19 +0200
Message-ID: <CANUQDChzB7EYyx8QOPgDC2TPR7n-h-dK43tHDfTZ=ocHPLHSOQ@mail.gmail.com>
To: PHP Internals <internals@lists.php.net>, Jakub Zelenka <bukka@php.net>
Content-Type: multipart/alternative; boundary="001a1134e75ea88cd60550a790ba"
Subject: Re: [RFC] Distrust SHA-1 Certificates
From: me@kelunik.com (Niklas Keller)

--001a1134e75ea88cd60550a790ba
Content-Type: text/plain; charset="UTF-8"

Morning Internals,

I have updated the RFC to use a "min_signature_bits" setting instead.

Please share your thoughts.

https://wiki.php.net/rfc/distrust-sha1-certificates

Regards, Niklas

2016-11-26 16:49 GMT+01:00 Niklas Keller <me@kelunik.com>:

> Morning Internals,
>
> I plan to distrust SHA-1 certificates by default in PHP 7.2. All major
> browsers will no longer trust SHA-1 certificates starting already
> 2017-01-01.
>
> Unfortunately, PHP doesn't even provide a way yet to limit the accepted
> algorithms for certificates. The RFC fixes that and introduces new defaults
> for PHP 7.2. The "signature_algorithms" context option will also be
> backported to PHP 5.6, which is only supported until the end of 2016 with
> regular releases, but after that there will be two more years of
> security-only updates. Therefore I'd like to get this done before the end
> of 2016.
>
> Currently the RFC aims for BC and doesn't restrict the algorithms on older
> versions. As all major browsers start distrusting those certificates on
> 2017-01-01 I'm not sure whether that's the correct choice. I'd like to go
> secure-by-default there and disable SHA-1 also on older versions. People
> which really need longer can always opt-out and add the needed algorithms
> again. Unfortunately, we didn't announce any plans regarding SHA-1 yet, so
> this might be a bit last-minute.
>
> You can read the full RFC in the wiki: https://wiki.php.net/
> rfc/distrust-sha1-certificates
>
> Regards, Niklas
>

--001a1134e75ea88cd60550a790ba--