Disable experimental post-quantum key exchange mechanism X25519Kyber768Draft00
#4583
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…68Draft00 The AWS Provider was upgraded to Go 1.23 in v6.51.0, which introduced a change to the crypto/tls standard library package. It enabled the post-quantum key exchange mechanism `X25519Kyber768Draft00` by default. This experimental key exchange mechanism is causing errors in the AWS firewall. As a short term workaround this change disables the experimental key exchange mechanism. Upstream maintainers and AWS are in touch to work on a long-term fix.
flostadler
changed the title
X25519Kyber768Draft00
iwahbe
approved these changes
Sep 30, 2024
I was not able to trigger it myself. Our existing test didn't catch it either. This is a tricky issue because it seems to be triggered by the length of the TLS ClientHello message. This new key-exchange mechanism causes the length to increase, in certain circumstances this seems to trigger an error in the AWS firewalls. |
Does the PR have any schema changes?Looking good! No breaking changes found. Maintainer note: consult the runbook for dealing with any breaking changes. |
|
/release patch |
github-actions
bot
added
the
needs-release/patch
|
Thank you for a quick turnaround on #4573 ! |
|
This PR has been shipped in release v6.54.1. |
zemnmez-renovate-bot
added a commit
to zemn-me/monorepo
that referenced
this pull request
Sep 30, 2024
##### [`v6.54.1](https://github.com/pulumi/pulumi-aws/releases/tag/v6.54.1) ##### Does the PR have any schema changes? Looking good! No breaking changes found. No new resources/functions. #### What's Changed - Disable experimental post-quantum key exchange mechanism `X25519Kyber768Draft00` by [@flostadler](https://github.com/flostadler) in pulumi/pulumi-aws#4583 **Full Changelog**: pulumi/pulumi-aws@v6.54.0...v6.54.1
github-actions
bot
removed
the
needs-release/patch
github-merge-queue bot
pushed a commit
to zemn-me/monorepo
that referenced
this pull request
Sep 30, 2024
##### [`v6.54.1](https://github.com/pulumi/pulumi-aws/releases/tag/v6.54.1) ##### Does the PR have any schema changes? Looking good! No breaking changes found. No new resources/functions. #### What's Changed - Disable experimental post-quantum key exchange mechanism `X25519Kyber768Draft00` by [@flostadler](https://github.com/flostadler) in pulumi/pulumi-aws#4583 **Full Changelog**: pulumi/pulumi-aws@v6.54.0...v6.54.1
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The AWS Provider was upgraded to Go 1.23 in v6.51.0, which introduced a change
to the crypto/tls standard library package. It enabled the post-quantum
key exchange mechanism
X25519Kyber768Draft00by default. This experimental keyexchange mechanism is causing errors in the AWS firewall.
As a short term workaround this change disables the experimental key exchange mechanism.
Upstream maintainers and AWS are in touch to work on a long-term fix.
Fixes #4573
Relates to #4582