weak digest algorithm for PKI

[Brant Knudson]

The digest algorithm for PKI tokens is the openssl default of sha1. This is a weak algorithm and some security standards require a stronger algorithm such as sha256. Keystone should make the token digest hash algorithm configurable so that deployments can use a stronger algorithm.

Also, the default could be stronger.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/117366

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/117367

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/117371

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/117372

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/117380

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/117371
Committed: https://git.openstack.org/cgit/openstack/python-keystoneclient/commit/?id=84c9ccaed34d83b7e97a4890561b1b218d99b1ba
Submitter: Jenkins
Branch: master

commit 84c9ccaed34d83b7e97a4890561b1b218d99b1ba
Author: Brant Knudson <email address hidden>
Date: Wed Aug 27 17:50:19 2014 -0500

    Change cms_sign_data to use sha256 message digest

    cms_sign_data was not passing the md parameter to openssl, so it was
    using the default digest of sha1. Some security standards require a
    SHA2 algorithm for the digest.

    This if for security hardening.

    SecurityImpact

    Change-Id: Iff063149e1f12df69bbf9015222d09d798980872
    Closes-Bug: #1362343

[OpenStack Infra (hudson-openstack)]

Change abandoned by Morgan Fainberg (<email address hidden>) on branch: master
Review: https://review.openstack.org/117380
Reason: This change is being abandoned because it has a negative score and has not seen an update in > 60 days. Feel free to re-instate this patch (as the author) by using the "restore" button or any member of the core team can re-instate the patch.

[Dolph Mathews (dolph)]

I'd suggest marking this as Won't Fix in keystone since pki_setup and ssl_setup are only really useful to developers. Production deployments should use real certificates.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Brant Knudson (<email address hidden>) on branch: master
Review: https://review.openstack.org/117366
Reason: Makes sense to tell people to use their own certs instead.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Brant Knudson (<email address hidden>) on branch: master
Review: https://review.openstack.org/117367
Reason: Abandoned parent

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/117372
Committed: https://git.openstack.org/cgit/openstack/python-keystoneclient/commit/?id=b317e312aadbdbbe8937172bc5d4a7dd2a8d68d9
Submitter: Jenkins
Branch: master

commit b317e312aadbdbbe8937172bc5d4a7dd2a8d68d9
Author: Brant Knudson <email address hidden>
Date: Wed Aug 27 17:53:41 2014 -0500

    token signing support alternative message digest

    The functions for creating signed tokens in common.cms always used
    sha256 for the message digest. This might be inadequate in the future
    so the digest algorithm shouldn't be hard-coded. A parameter is added
    to allow choosing a different digest algorithm.

    SecurityImpact

    Change-Id: Ie19d093d0494443ce4cd880ae1f92dffd5c361ef
    Related-Bug: #1362343

[Morgan Fainberg (mdrnstm)]

PKI Tokens are Deprecated