Date: Wed, 20 Jun 2018 08:33:33 -0500 From: Benjamin Kaduk <bjkfbsd@gmail.com> To: "Simon J. Gerraty" <sjg@juniper.net> Cc: "cem@FreeBSD.org" <cem@freebsd.org>, svn-src-head@freebsd.org, svn-src-all@freebsd.org, src-committers <src-committers@freebsd.org>, "Stephen J. Kiernan" <stevek@freebsd.org> Subject: Re: svn commit: r335402 - head/sbin/veriexecctl Message-ID: <CAJ5_RoBvwNH7-ZCd3LxtXg21TE49uX2y35Jwa6MM%2Bwn%2BX0_wUQ@mail.gmail.com> In-Reply-To: <96021.1529475664@kaos.jnpr.net> References: <201806200108.w5K18sIR050132@repo.freebsd.org> <CAG6CVpV124ze%2BY6xX2ZFqbM%2B3hJNEJWR2qpnChpey=PmiW6qXg@mail.gmail.com> <96021.1529475664@kaos.jnpr.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Jun 20, 2018 at 1:21 AM, Simon J. Gerraty <sjg@juniper.net> wrote: > Conrad Meyer <cem@freebsd.org> wrote: > > > There's absolutely no reason to use sha1 or ripemd in new designs. > > These should be removed. > > Sorry I disagree - not with ripem (we never supported that or any of the > non-NIST approved hashes), but sha1 is still approved by NIST for > firmware integrity checks - which is what this is, and sha1 is cheaper > than sha256. > > As I mentioned in my talk we've included support for sha256 for 10+ > years, but do not plan to drop sha1 until NIST deprecate it for that > purpose since boot time is a very sensitive subject for us. > With all due respect, NIST is hardly the sole authority on this topic. Over in the IETF, we have the SUIT working group that is even considering hash-based signatures for firmware updates for post-quantum resistance (so that devices can be shipped now that have 20-year lifecycles can have some expectation of retaining the ability to securely take updates over that lifecycle, admittedly). With my IETF Security Area Director hat on, any greenfield proposal coming in to the IESG that included sha1 support would get extremely strong pushback, and I don't expect that "reducing boot time" would be seen as sufficiently compelling. -Ben
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAJ5_RoBvwNH7-ZCd3LxtXg21TE49uX2y35Jwa6MM%2Bwn%2BX0_wUQ>