| Message ID | 20211019183127.614175-5-arne@rfc2549.org |
|---|---|
| State | Accepted |
| Headers | show |
| Series | OpenSSL 3.0 improvements for OpenVPN | expand |
On 19/10/2021 20:31, Arne Schwabe wrote: > DES is very deprecated and accidently getting on the of the 16 insecure > keys that OpenSSL checks is extremely unlikely so we no longer use the > deprecated functions without replacement in OpenSSL 3.0. > > Signed-off-by: Arne Schwabe <arne@rfc2549.org> > --- > src/openvpn/crypto_openssl.c | 8 ++++++++ > 1 file changed, 8 insertions(+) > > diff --git a/src/openvpn/crypto_openssl.c b/src/openvpn/crypto_openssl.c > index 021698f12..8db2ddd09 100644 > --- a/src/openvpn/crypto_openssl.c > +++ b/src/openvpn/crypto_openssl.c > @@ -521,6 +521,11 @@ key_des_num_cblocks(const EVP_CIPHER *kt) > bool > key_des_check(uint8_t *key, int key_len, int ndc) > { > +#if OPENSSL_VERSION_NUMBER < 0x30000000L > + /* DES is deprecated and the method to even check the keys is deprecated > + * in OpenSSL 3.0. Instead of checking for the 16 weak/semi-weak keys > + * we just accept them in OpenSSL 3.0 since the risk of randomly getting > + * these is pretty weak */ > int i; > struct buffer b; > > @@ -553,6 +558,9 @@ key_des_check(uint8_t *key, int key_len, int ndc) > err: > ERR_clear_error(); > return false; > +#else > + return true; > +#endif > } > > void > The code change looks good to me. Dropping the check is no loss because *all* DES keys are weak keys. The comment probably makes more sense in the #else branch, or before the version check. Since I'm already nitpicking, it should be "the risk is low", not "weak".
Acked-by: Gert Doering <gert@greenie.muc.de> Taking MaxF review into account, moving the comment as suggested, and changing "risk ... is ... weak" to "low". Your patch has been applied to the master branch. commit d67658feeab4742b9b6f57806ba8e93c8eec75b8 Author: Arne Schwabe Date: Tue Oct 19 20:31:10 2021 +0200 Remove DES check with OpenSSL 3.0 Signed-off-by: Arne Schwabe <arne@rfc2549.org> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <20211019183127.614175-5-arne@rfc2549.org> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23004.html Signed-off-by: Gert Doering <gert@greenie.muc.de> -- kind regards, Gert Doering
diff --git a/src/openvpn/crypto_openssl.c b/src/openvpn/crypto_openssl.c index 021698f12..8db2ddd09 100644 --- a/src/openvpn/crypto_openssl.c +++ b/src/openvpn/crypto_openssl.c @@ -521,6 +521,11 @@ key_des_num_cblocks(const EVP_CIPHER *kt) bool key_des_check(uint8_t *key, int key_len, int ndc) { +#if OPENSSL_VERSION_NUMBER < 0x30000000L + /* DES is deprecated and the method to even check the keys is deprecated + * in OpenSSL 3.0. Instead of checking for the 16 weak/semi-weak keys + * we just accept them in OpenSSL 3.0 since the risk of randomly getting + * these is pretty weak */ int i; struct buffer b; @@ -553,6 +558,9 @@ key_des_check(uint8_t *key, int key_len, int ndc) err: ERR_clear_error(); return false; +#else + return true; +#endif } void
DES is very deprecated and accidently getting on the of the 16 insecure keys that OpenSSL checks is extremely unlikely so we no longer use the deprecated functions without replacement in OpenSSL 3.0. Signed-off-by: Arne Schwabe <arne@rfc2549.org> --- src/openvpn/crypto_openssl.c | 8 ++++++++ 1 file changed, 8 insertions(+)