Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:99745
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain kelunik.com from 81.169.146.218 cause and error)
MIME-Version: 1.0
In-Reply-To: <HE1PR02MB10526A125B744FEA01F67B63BAD70@HE1PR02MB1052.eurprd02.prod.outlook.com>
References: <CANUQDCiUYNwH_tkZyS_cbWVa1X=4CAA3_14VD+fYjAXk-JU=1g@mail.gmail.com>
 <CANUQDChzB7EYyx8QOPgDC2TPR7n-h-dK43tHDfTZ=ocHPLHSOQ@mail.gmail.com>
 <CAEKnhAH8eGzcUsWODc75_L1kq4OtF2bvR7qJkijWWSVoY7c_mQ@mail.gmail.com>
 <CANUQDChVGuF1rrG3+AVTT+pp0nEmDw7MXyGGX7nVbQ42Kpgytw@mail.gmail.com>
 <CAEKnhAH78Uey_Tp43UY+AVaADi-ckvtBW9EqsuKTj8iDfK+AGQ@mail.gmail.com>
 <CANUQDCivjqg_NN+Zr_ZWWxh8mQyV3JVi1JDSY-ymVoc8ZKyR6w@mail.gmail.com>
 <HE1PR02MB1052A742CD23C1CA9DF54F6EBAD60@HE1PR02MB1052.eurprd02.prod.outlook.com>
 <CANUQDChRXr3FB+fa7744KaBBvawQ+QhLn8z46qAaAdU85pxtbw@mail.gmail.com> <HE1PR02MB10526A125B744FEA01F67B63BAD70@HE1PR02MB1052.eurprd02.prod.outlook.com>
Date: Tue, 4 Jul 2017 20:25:09 +0200
Message-ID: <CANUQDCgjsC-SJbFDpdZeWLzSHeF8RivGP_XZwsdELWtOesdcmQ@mail.gmail.com>
To: Anatol Belski <weltling@outlook.de>
Cc: Sara Golemon <pollita@php.net>, Jakub Zelenka <bukka@php.net>, 
	PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="001a1134f6cce94eeb05538200d0"
Subject: Re: [PHP-DEV] Re: [RFC] Distrust SHA-1 Certificates
From: me@kelunik.com (Niklas Keller)

--001a1134f6cce94eeb05538200d0
Content-Type: text/plain; charset="UTF-8"

2017-07-04 13:11 GMT+02:00 Anatol Belski <weltling@outlook.de>:

> Hi Niklas,
>
> > -----Original Message-----
> > From: Niklas Keller [mailto:me@kelunik.com]
> > Sent: Monday, July 3, 2017 7:13 PM
> > To: Anatol Belski <weltling@outlook.de>; Sara Golemon <pollita@php.net>
> > Cc: Jakub Zelenka <bukka@php.net>; PHP Internals <
> internals@lists.php.net>
> > Subject: Re: [PHP-DEV] Re: [RFC] Distrust SHA-1 Certificates
> >
> > I think the best approach for now would be that:
> >
> > Add two new context options for the "ssl" wrapper:
> > "insecure_allow_md5_signature" and "insecure_allow_sha1_signature". They
> > will both default to false starting in PHP 7.2 while the backports to
> PHP 7.1 and
> > 7.0 will default to true. Additionally there will be two INI options
> which are only
> > added to PHP 7.1 and 7.0 to allow people to immediately upgrade to secure
> > defaults without any risk of breaking other apps.
> >
> Same as Ferenc, I couldn't find anything in other languages but this about
> Java http://openjdk.java.net/jeps/288 . Seems a well thought approach and
> your suggestion about the stream context is similar.
>

I asked in #python-dev on Freenode yesterday. The response I got was that
it's something on the TODO list, but they don't see it as high priority and
the person I talked to said it would only be a defense-in-depth, which it
is not, it's a vulnerability.


> Probably it is the minimum, whereby the JDK has more flexible options and
> more constraints, which might be too flexible for us.Anyway, users are more
> in control about more details, in PHP we still hide many details. For
> example, consider things like `RSA keySize < 1024`, it is solvable in PHP
> with the stream context option, but hardly through INI. And this one is fun
> `SHA1 usage SignedJAR & denyAfter 2017-01-01`, too.
>

Regards, Niklas

--001a1134f6cce94eeb05538200d0--