Set secure defaults for the SHAKE 128/256 digest output length.#23877
Uh oh!
There was an error while loading. Please reload this page.
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
This is a breaking change that affects using SHAKE with EVP_DigestFinal(). This should be resolved BEFORE we add support for signing with SHAKE, See (PR openssl#23114) which is currently dependant on PR openssl#22684 (Support for fixed output length SHAKE algorithms). This was going to be used by LMS also. Leaving the code as it was may allow backwards compatability, but it would not interop nicely with signatures coming from another toolkit, and would be inconsistent with the Fixed output length SHAKE algorithms. Note that the algorithms will also map back to OIDS (so having 2 names for SHAKE-256, (one that mays back to a bad output size and one that is the correct size) does not allow a nice mapping back to a single OID.
slontis added branch: master 
github-actionsbot added the severity: fips change 
2 tasks
Collaborator
openssl-machine commented Apr 18, 2024
This PR is in a state where it requires action by @openssl/otc but the last update was 30 days ago |
MemberAuthor
slontis commented Apr 23, 2024
Dropping this PR in favor of #24105 (Assuming that the changes discussed will be added to that PR). |
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is a breaking change that affects using SHAKE with EVP_DigestFinal().
This should be resolved BEFORE we add support for signing with SHAKE, See (PR #23114) which is currently dependant on PR #22684 (Support for fixed output length SHAKE algorithms). This was going to be used by LMS also.
Leaving the code as it was may allow backwards compatability, but it would not interop nicely with signatures coming from another toolkit, and would be inconsistent with the Fixed output length SHAKE algorithms. Note that the algorithms will also map back to OIDS (so having 2 names for SHAKE-256, (one that mays back to a bad output size and one that is the correct size) does not allow a nice mapping back to a single OID.
Checklist