revert tls security level back to 1
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
openssl (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned | ||
Cosmic |
Fix Released
|
Undecided
|
Unassigned | ||
Disco |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
[Impact]
* increase minimum default tls security level from 0 to 1, as is the default upstream
[Test Case]
* generate 80bits TLS certificate and attempt to use it
* with prior openssl it should work, but with this update it should fail
[Regression Potential]
* This increases the minimum required certificate/keys sizes and algorithms, back to what Bionic GA openssl 1.1.0 shipped as. It also now will match upstream default. It is still lower than Debian's default that raises it to 2 by default.
* Cosmic GA shipped with TLS_SECURITY_LEVEL 0, meaning pretty much any weak keys were accepted. With this change keys lower than 112 will be rejected, which are considered to be too weak to be useful by most CAs out there.
Changed in openssl (Ubuntu Disco): | |
status: | New → Fix Committed |
Changed in openssl (Ubuntu Cosmic): | |
status: | New → In Progress |
that regression potential doesn't really describe what might regress... I think it could be improved.
since you asked me to review, can you give a bit more context for the change please? why did we have the patch before and why can it be removed now?