[#100309] How to use backport custom field — Jun Aruga <jaruga@...>
Please allow my ignorance.
9 messages
2020/10/06
[#100310] Re: How to use backport custom field
— "NARUSE, Yui" <naruse@...>
2020/10/06
IkJhY2twb3J0IGN1c3RvbSBmaWVsZCIgaXMgb25seSBhdmFpbGFibGUgZm9yIHRpY2tldHMgd2hv
[#100311] Re: How to use backport custom field
— Jun Aruga <jaruga@...>
2020/10/06
On Tue, Oct 6, 2020 at 4:44 PM NARUSE, Yui <[email protected]> wrote:
[#100314] Re: How to use backport custom field
— "NARUSE, Yui" <naruse@...>
2020/10/06
VGhhbmsgeW91IGZvciBjb25maXJtYXRpb24uCkkgY2hlY2tlZCBhZ2FpbiBhbmQgdG8gZWRpdCBi
[#100322] Re: How to use backport custom field
— Jun Aruga <jaruga@...>
2020/10/07
On Tue, Oct 6, 2020 at 7:25 PM NARUSE, Yui <[email protected]> wrote:
[#100326] Re: How to use backport custom field
— "NARUSE, Yui" <naruse@...>
2020/10/07
SSBhZGRlZCB5b3UgdG8gIlJlcG9ydGVyIiByb2xlIGluIHRoZSBwcm9qZWN0CgoyMDIw5bm0MTDm
[#100327] Re: How to use backport custom field
— Jun Aruga <jaruga@...>
2020/10/07
On Wed, Oct 7, 2020 at 1:42 PM NARUSE, Yui <[email protected]> wrote:
[ruby-core:100522] [Ruby master Feature#17282] Deprecate Digest::SHA1
From:
merch-redmine@...
Date:
2020-10-24 05:34:50 UTC
List:
ruby-core #100522
Issue #17282 has been updated by jeremyevans0 (Jeremy Evans). Note that we don't currently even deprecate MD5, and if we were going to deprecate SHA1 due to security issues, we should deprecate MD5 first since it's even worse. I think we should strongly discourage the use of MD5 and SHA1 in the Digest documentation, but a deprecation warning on usage is going too far. Not all usage of SHA1 is vulnerable (e.g. HMAC-SHA1), and SHA1 is still in wide enough usage (e.g. git) that a deprecation warning on usage is going to be annoying. These days, the majority of usage of SHA1 in Ruby is not when you are choosing the algorithm, but when you are forced to use the algorithm in order to interact with other software and usage is unavoidable. I think we shouldn't deprecate Digest::SHA1 (or Digest::MD5) until we plan on removing it the next Ruby release. I'm in favor of SHA3 support being added to Digest, but please submit a separate ticket for that. ---------------------------------------- Feature #17282: Deprecate Digest::SHA1 https://bugs.ruby-lang.org/issues/17282#change-88144 * Author: olivierlacan (Olivier Lacan) * Status: Open * Priority: Normal ---------------------------------------- In light of the widespread deprecation of SHA1 due to collision risk it poses, should Ruby still expose it without a warning within Digest::SHA1? [FIPS PUB 180-1](https://csrc.nist.gov/publications/detail/fips/180/1/archive/1995-04-17) which is referenced by the [Digest::SHA1 documentation](https://docs.ruby-lang.org/en/master/Digest/SHA1.html) was withdraw on August 01, 2002, superseded by [FIPS 180-2](https://csrc.nist.gov/publications/detail/fips/180/2/archive/2002-08-01) (which introduced SHA-256, SHA-384, and SHA-512), and later withdrawn and superseded multiple times until [FIPS 180-4](https://csrc.nist.gov/publications/detail/fips/180/4/final) which recommends SHA3. SHA3 isn't currently supported by the Digest class although there exists Ruby gem implementations: - https://github.com/johanns/sha3 - https://github.com/phusion/digest-sha3-ruby References: - https://mailarchive.ietf.org/arch/msg/openpgp/Rp-inhYKT8A9H5E34iLTrc9I0gc/ - https://csrc.nist.gov/news/2017/research-results-on-sha-1-collisions - https://csrc.nist.gov/publications/detail/sp/800-131a/rev-1/archive/2015-11-06 - https://csrc.nist.gov/publications/detail/sp/800-131a/rev-2/final Quoting from NIST's piece on research regarding SHA1 collisions: > NIST deprecated the use of SHA-1 in 2011 and disallowed its use for digital signatures at the end of 2013, based on both the Wang, et. al, attack and the potential for brute-force attack. To ensure that practitioners have secure and efficient hash algorithms to provide long-term security, NIST organized an international competition to select a new hash algorithm standard, SHA-3, which is specified in FIPS 202. My recommendation would be to print a deprecation warning when Digest::SHA1 is used to alert Ruby users that they should perhaps upgrade to a safer standard. SHA3 should perhaps be supported by Digest as well. -- https://bugs.ruby-lang.org/ Unsubscribe: <mailto:[email protected]?subject=unsubscribe> <http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-core>