Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[20.10 backport] context: deprecate support for encrypted TLS private keys #3219

Merged
merged 2 commits into from
Jul 29, 2021
Merged

[20.10 backport] context: deprecate support for encrypted TLS private keys #3219

merged 2 commits into from
Jul 29, 2021

Commits on Jul 28, 2021

  1. cli/context: ignore linting warnings about RFC 1423 encryption 

    From https://go-review.googlesource.com/c/go/+/264159

> It's unfortunate that we don't implement PKCS#8 encryption so we can't
> recommend an alternative but PEM encryption is so broken that it's worth
> deprecating outright.

When linting on Go 1.16:

    cli/context/docker/load.go:69:6: SA1019: x509.IsEncryptedPEMBlock is deprecated: Legacy PEM encryption as specified in RFC 1423 is insecure by design. Since it does not authenticate the ciphertext, it is vulnerable to padding oracle attacks that can let an attacker recover the plaintext.  (staticcheck)
            if x509.IsEncryptedPEMBlock(pemBlock) {
               ^
    cli/context/docker/load.go:70:20: SA1019: x509.DecryptPEMBlock is deprecated: Legacy PEM encryption as specified in RFC 1423 is insecure by design. Since it does not authenticate the ciphertext, it is vulnerable to padding oracle attacks that can let an attacker recover the plaintext.  (staticcheck)
                keyBytes, err = x509.DecryptPEMBlock(pemBlock, []byte(c.TLSPassword))
                                ^

Signed-off-by: Sebastiaan van Stijn <[email protected]>
(cherry picked from commit 2688f25)
Signed-off-by: Sebastiaan van Stijn <[email protected]>
    @thaJeztah
    thaJeztah committed Jul 28, 2021
    Configuration menu
    Copy the full SHA
    68a5ca8 View commit details
    Browse the repository at this point in the history

  2. context: deprecate support for encrypted TLS private keys 

    > Legacy PEM encryption as specified in RFC 1423 is insecure by design. Since
> it does not authenticate the ciphertext, it is vulnerable to padding oracle
> attacks that can let an attacker recover the plaintext

From https://go-review.googlesource.com/c/go/+/264159

> It's unfortunate that we don't implement PKCS#8 encryption so we can't
> recommend an alternative but PEM encryption is so broken that it's worth
> deprecating outright.

Signed-off-by: Sebastiaan van Stijn <[email protected]>
(cherry picked from commit 15535d4)
Signed-off-by: Sebastiaan van Stijn <[email protected]>
    @thaJeztah
    thaJeztah committed Jul 28, 2021
    Configuration menu
    Copy the full SHA
    8437cfe View commit details
    Browse the repository at this point in the history