GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — bpo-34399: 2048 bits RSA keys and DH params by tiran · Pull Request #8762 · python/cpython

Conversation

@tiran

@tiran tiran commented Aug 14, 2018 •
edited by bedevere-bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

Downstream vendors have started to deprecate weak keys. Update all RSA keys
and DH params to use at least 2048 bits.

Signed-off-by: Christian Heimes [email protected]

https://bugs.python.org/issue34399

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
@tiran tiran added needs backport to 3.6 labels Aug 14, 2018
@the-knights-who-say-ni the-knights-who-say-ni added the CLA signed label Aug 14, 2018
@bedevere-bot bedevere-bot added the awaiting merge label Aug 14, 2018
@tiran

tiran commented Aug 14, 2018

Copy link
Copy Markdown
Member Author

NOTE: 2.7 and 3.6 need additional fixes from GH-5247

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

nmav
nmav reviewed Aug 14, 2018
View reviewed changes
Comment thread Lib/test/dh2048.pem Outdated

@nmav nmav Aug 14, 2018

Copy link
Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

one improvement towards future-compatibility could be to use standardized DH prime parameters e.g., from rfc7919. Thinking of future implementation change which could verify that the primes used come from a known set params.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
@tiran
tiran force-pushed the bpo34399-key2048bits branch from 4d1f20e to 6ffe200 Compare August 14, 2018 09:53
@tiran

tiran commented Aug 14, 2018

Copy link
Copy Markdown
Member Author

@nmav I have updated the DH test file to use RFC 7919 high FFDH parameters with 3072 bits.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@tiran
bpo-34399: 2048 bits RSA keys and DH params
b46f02e
Downstream vendors have started to deprecate weak keys. Update all RSA keys
and DH params to use at least 2048 bits.

Finite field DH param file use RFC 7919 values, generated with

    certtool --get-dh-params --sec-param=high

Signed-off-by: Christian Heimes <[email protected]>
@tiran
tiran force-pushed the bpo34399-key2048bits branch from 6ffe200 to b46f02e Compare August 14, 2018 09:54
@tiran
tiran merged commit 88bfd0b into python:master Aug 14, 2018
@bedevere-bot

bedevere-bot commented Aug 14, 2018

Copy link
Copy Markdown

@tiran: Please replace # with GH- in the commit message next time. Thanks!

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@miss-islington

miss-islington commented Aug 14, 2018

Copy link
Copy Markdown
Contributor

Thanks @tiran for the PR 🌮🎉.. I'm working now to backport this PR to: 2.7, 3.6, 3.7.
🐍🍒⛏🤖

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@bedevere-bot bedevere-bot removed the awaiting merge label Aug 14, 2018
@tiran
tiran deleted the bpo34399-key2048bits branch August 14, 2018 10:54
@bedevere-bot

bedevere-bot commented Aug 14, 2018

Copy link
Copy Markdown

GH-8763 is a backport of this pull request to the 3.7 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@bedevere-bot bedevere-bot removed the needs backport to 3.7 label Aug 14, 2018
@miss-islington

miss-islington commented Aug 14, 2018

Copy link
Copy Markdown
Contributor

Sorry, @tiran, I could not cleanly backport this to 3.6 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker 88bfd0bce05043f658e50addd21366f317995e35 3.6

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@miss-islington miss-islington assigned tiran Aug 14, 2018
@miss-islington

miss-islington commented Aug 14, 2018

Copy link
Copy Markdown
Contributor

Sorry, @tiran, I could not cleanly backport this to 2.7 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker 88bfd0bce05043f658e50addd21366f317995e35 2.7

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Aug 14, 2018
@tiran @miss-islington
bpo-34399: 2048 bits RSA keys and DH params (pythonGH-8762)
46205b7
Downstream vendors have started to deprecate weak keys. Update all RSA keys
and DH params to use at least 2048 bits.

Finite field DH param file use RFC 7919 values, generated with

    certtool --get-dh-params --sec-param=high

Signed-off-by: Christian Heimes <[email protected]>
(cherry picked from commit 88bfd0b)

Co-authored-by: Christian Heimes <[email protected]>
@bedevere-bot

bedevere-bot commented Aug 14, 2018

Copy link
Copy Markdown

GH-8764 is a backport of this pull request to the 3.6 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@bedevere-bot bedevere-bot removed the needs backport to 3.6 label Aug 14, 2018
@bedevere-bot

bedevere-bot commented Aug 14, 2018

Copy link
Copy Markdown

GH-8765 is a backport of this pull request to the 2.7 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@bedevere-bot bedevere-bot removed the needs backport to 2.7 label Aug 14, 2018
tiran added a commit to tiran/cpython that referenced this pull request Aug 14, 2018
@tiran
[2.7] bpo-34399: 2048 bits RSA keys and DH params (pythonGH-8762)
6e15bb2
Downstream vendors have started to deprecate weak keys. Update all RSA keys
and DH params to use at least 2048 bits.

Finite field DH param file use RFC 7919 values, generated with

    certtool --get-dh-params --sec-param=high

Signed-off-by: Christian Heimes <[email protected]>.
(cherry picked from commit 88bfd0b)

Co-authored-by: Christian Heimes <[email protected]>
tiran added a commit to tiran/cpython that referenced this pull request Aug 14, 2018
@tiran
[3.6] bpo-34399: 2048 bits RSA keys and DH params (pythonGH-8762)
c42b5ac
Downstream vendors have started to deprecate weak keys. Update all RSA keys
and DH params to use at least 2048 bits.

Finite field DH param file use RFC 7919 values, generated with

    certtool --get-dh-params --sec-param=high

Signed-off-by: Christian Heimes <[email protected]>.
(cherry picked from commit 88bfd0b)

Co-authored-by: Christian Heimes <[email protected]>
tiran added a commit that referenced this pull request Aug 14, 2018
@miss-islington @tiran
bpo-34399: 2048 bits RSA keys and DH params (GH-8762) (GH-8763)
e3228a3
Downstream vendors have started to deprecate weak keys. Update all RSA keys
and DH params to use at least 2048 bits.

Finite field DH param file use RFC 7919 values, generated with

    certtool --get-dh-params --sec-param=high

Signed-off-by: Christian Heimes <[email protected]>
(cherry picked from commit 88bfd0b)

Co-authored-by: Christian Heimes <[email protected]>
tiran added a commit that referenced this pull request Aug 14, 2018
@tiran
[2.7] bpo-34399: 2048 bits RSA keys and DH params (GH-8762) (GH-8765)
1f34aec
Downstream vendors have started to deprecate weak keys. Update all RSA keys
and DH params to use at least 2048 bits.

Finite field DH param file use RFC 7919 values, generated with

    certtool --get-dh-params --sec-param=high

Signed-off-by: Christian Heimes <[email protected]>.
(cherry picked from commit 88bfd0b)

Co-authored-by: Christian Heimes <[email protected]>
tiran added a commit that referenced this pull request Aug 15, 2018
@tiran
[3.6] bpo-34399: 2048 bits RSA keys and DH params (GH-8762) (GH-8764)
5e9551b
Downstream vendors have started to deprecate weak keys. Update all RSA keys
and DH params to use at least 2048 bits.

Finite field DH param file use RFC 7919 values, generated with

    certtool --get-dh-params --sec-param=high

Signed-off-by: Christian Heimes <[email protected]>.
(cherry picked from commit 88bfd0b)

Co-authored-by: Christian Heimes <[email protected]>
carljm added a commit to carljm/cpython that referenced this pull request Aug 19, 2018
@carljm
Merge branch 'master' into cached-property
977ece0
* master: (107 commits)
  bpo-22057: Clarify eval() documentation (pythonGH-8812)
  bpo-34318: Convert deprecation warnings to errors in assertRaises() etc. (pythonGH-8623)
  bpo-22602: Raise an exception in the UTF-7 decoder for ill-formed sequences starting with "+". (pythonGH-8741)
  bpo-34415: Updated logging.Formatter docstring. (pythonGH-8811)
  bpo-34432: doc Mention complex and decimal.Decimal on str.format not about locales (pythonGH-8808)
  bpo-34381: refer to 'Running & Writing Tests' in README.rst (pythonGH-8797)
  Improve error message when mock.assert_has_calls fails (pythonGH-8205)
  Warn not to set SIGPIPE to SIG_DFL (python#6773)
  bpo-34419: selectmodule.c does not compile on HP-UX due to bpo-31938 (pythonGH-8796)
  bpo-34418: Fix HTTPErrorProcessor documentation (pythonGH-8793)
  bpo-34391: Fix ftplib test for TLS 1.3 (pythonGH-8787)
  bpo-34217: Use lowercase for windows headers (pythonGH-8472)
  bpo-34395: Fix memory leaks caused by incautious usage of PyMem_Resize(). (pythonGH-8756)
  bpo-34405: Updated to OpenSSL 1.1.0i for Windows builds. (pythonGH-8775)
  bpo-34384: Fix os.readlink() on Windows (pythonGH-8740)
  closes bpo-34400: Fix undefined behavior in parsetok(). (pythonGH-4439)
  bpo-34399: 2048 bits RSA keys and DH params (python#8762)
  Make regular expressions in test_tasks.py raw strings. (pythonGH-8759)
  smtplib documentation fixes (pythonGH-8708)
  Fix misindented yaml in logging how to example (pythonGH-8604)
  ...
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@nmav nmav nmav left review comments
Reviewers whose approvals may not affect merge requirements

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@tiran tiran

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

5 participants

@tiran @bedevere-bot @miss-islington @nmav @the-knights-who-say-ni
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.