Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:99882
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.161.171 as permitted sender)
MIME-Version: 1.0
Sender: jakub.php@gmail.com
In-Reply-To: <CANUQDChHAp8-QQL1bBoR9SqaZVoHZ-2qFGxErr1ij07SnSPhag@mail.gmail.com>
References: <CANUQDCiUYNwH_tkZyS_cbWVa1X=4CAA3_14VD+fYjAXk-JU=1g@mail.gmail.com>
 <CANUQDChzB7EYyx8QOPgDC2TPR7n-h-dK43tHDfTZ=ocHPLHSOQ@mail.gmail.com>
 <CAEKnhAH8eGzcUsWODc75_L1kq4OtF2bvR7qJkijWWSVoY7c_mQ@mail.gmail.com>
 <CANUQDChVGuF1rrG3+AVTT+pp0nEmDw7MXyGGX7nVbQ42Kpgytw@mail.gmail.com>
 <CAEKnhAH78Uey_Tp43UY+AVaADi-ckvtBW9EqsuKTj8iDfK+AGQ@mail.gmail.com>
 <CANUQDCivjqg_NN+Zr_ZWWxh8mQyV3JVi1JDSY-ymVoc8ZKyR6w@mail.gmail.com>
 <HE1PR02MB1052A742CD23C1CA9DF54F6EBAD60@HE1PR02MB1052.eurprd02.prod.outlook.com>
 <CANUQDChRXr3FB+fa7744KaBBvawQ+QhLn8z46qAaAdU85pxtbw@mail.gmail.com>
 <CAESVnVoO-Pe+SQeCn1gywQaZA4z4nL7Mtq+7PwYWeAbP=3juZQ@mail.gmail.com>
 <CANUQDChhO7A6by5tcimeEobaP-4k1TRsm4sXh75=K2sCi5HzHQ@mail.gmail.com>
 <HE1PR02MB105234EBBCC3B38F2D5105B3BAD70@HE1PR02MB1052.eurprd02.prod.outlook.com>
 <CANUQDChnN1Mi6E-EUPgFkr5muHCkQt7xDA5F8oy5h2Cxph6Q3w@mail.gmail.com>
 <HE1PR02MB1052F972CF1C581D0A38EB76BAD70@HE1PR02MB1052.eurprd02.prod.outlook.com>
 <CANUQDChUwSWmXj4ddsTs8Zqbvku3bVQJBGc2605Zxysg+NgO+Q@mail.gmail.com>
 <HE1PR02MB105289B5F24BE29088A82C72BAD70@HE1PR02MB1052.eurprd02.prod.outlook.com>
 <CANUQDChcHqbmhbb3H9c10a=DE3Smm3aagOCFd+8dx4NyMPaLGA@mail.gmail.com>
 <HE1PR02MB1052BB64ED18F8AEF2B6B701BAD40@HE1PR02MB1052.eurprd02.prod.outlook.com>
 <CANUQDCgQj6AsGLUAwfPYwhLA+4mbZNRkdmVh2-Ms45q8Suuk9w@mail.gmail.com>
 <HE1PR02MB1052F6DCE13BFC510F92E0E7BAD50@HE1PR02MB1052.eurprd02.prod.outlook.com>
 <HE1PR02MB10525C8674C3C8655DA0F844BAA90@HE1PR02MB1052.eurprd02.prod.outlook.com>
 <CAEKnhAEdo69u1gnuNX3OvM-1XayOeHqJCbE9f21GGCf+i-Nfww@mail.gmail.com>
 <CANUQDCjE9cj+jGWTnZRYHZwQfxMLF3w-4nA6YHoKn2Q_vJwGjQ@mail.gmail.com>
 <HE1PR02MB10527C685899CB2A34EBB1AEBAAC0@HE1PR02MB1052.eurprd02.prod.outlook.com>
 <CANUQDChHAp8-QQL1bBoR9SqaZVoHZ-2qFGxErr1ij07SnSPhag@mail.gmail.com>
Date: Mon, 17 Jul 2017 17:50:41 +0100
Message-ID: <CAEKnhAFzDRH8=jD5bNHBCgpMz2qFRtjSnKjq+6MdO4mY+_MwyA@mail.gmail.com>
To: Niklas Keller <me@kelunik.com>
Cc: Anatol Belski <weltling@outlook.de>, Sara Golemon <pollita@php.net>, 
	PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="94eb2c0336e80500fe05548633e9"
Subject: Re: [PHP-DEV] Re: [RFC] Distrust SHA-1 Certificates
From: bukka@php.net (Jakub Zelenka)

--94eb2c0336e80500fe05548633e9
Content-Type: text/plain; charset="UTF-8"

Hey,

On Mon, Jul 17, 2017 at 8:58 AM, Niklas Keller <me@kelunik.com> wrote:

> Hi,
>>
>> >       After reading related discussion on openssl-users [1], I'm not so
>> sure if
>> >       we should be doing that at all...
>> >
>> >       Especially I agree with this bit:
>> >
>> >       "Making your code more complex is a far higher risk than a
>> practical
>> >       certificate forgery based on a collision attack on SHA-1. "
>> >
>> >       The only thing, that makes sense IMHO would be adding support for
>> > setting
>> >       security level only for OpenSSL 1.1.
>> >
>> >       [1]
>> >       http://openssl.6102.n7.nabble.com/Rejecting-SHA-1-certificates-
>> > td71439.html <http://openssl.6102.n7.nabble.com/Rejecting-SHA-1-
>> > certificates-td71439.html>
>> >
>> >
>> > Same here actually. While it's trivial to implement with OpenSSL 1.1,
>> it's non-
>> > trivial before, because there's no API to get the trusted chain AFAIK,
>> so we
>> > would indeed have to do this inside verify_callback.
>> >
>> Thanks for the responses and for the discussion link. With that, the
>> situation is simplified a lot. This allows for a better conceived patch and
>> there's obviously no strong reason to touch the stable branches.
>>
>> Thanks.
>>
>> Anatol
>>
>
> @Jakub: Do we want to expose "auth_level" then in case PHP is linked
> against OpenSSL 1.1.0+?
>
>
>
I just pushed support for security_level [1] which is more comprehensive
and the patch is also very simple.

Apology for such last minute addition but I felt that it is really useful
for 7.2 and I have already messaged about that and haven't heard any
objections. Of course if anyone feels strongly against it, I will be happy
to reconsider it.

Cheers

Jakub

--94eb2c0336e80500fe05548633e9--