Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Drop SHA-1 fingerprints #3824

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Drop SHA-1 fingerprints #3824

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion base/ca/src/main/java/com/netscape/cms/servlet/cert/scep/CRSEnrollment.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1853,7 +1853,7 @@ public Hashtable<String, byte[]> makeFingerPrints(CRSPKIMessage req) {
Hashtable<String, byte[]> fingerprints = new Hashtable<>();

MessageDigest md;
String[] hashes = new String[] { "MD2", "MD5", "SHA1", "SHA256", "SHA512" };
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Drop MD2/MD5, add SHA-384?

String[] hashes = new String[] { "MD2", "MD5", "SHA256", "SHA512" };
PKCS10 p10 = req.getP10();

for (int i = 0; i < hashes.length; i++) {
Expand Down
16 changes: 6 additions & 10 deletions base/server/src/main/java/com/netscape/cmscore/cert/CertUtils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -768,27 +768,25 @@ public static String getFingerPrint(Certificate cert)

/**
* Returns a string that has the certificate's fingerprint using
* MD5, MD2 and SHA1 hashes.
* MD5 and MD2 hashes.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Drop MD2/MD5, add SHA-384?

* A certificate's fingerprint is a hash digest of the DER encoded
* certificate.
*
* @param cert Certificate to get the fingerprints of.
* @return a String with fingerprints using the MD5, MD2 and SHA1 hashes.
* @return a String with fingerprints using the MD5 and MD2 hashes.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Drop MD2/MD5, add SHA-384?

* For example,
*
* <pre>
* MD2: 78:7E:D1:F9:3E:AF:50:18:68:A7:29:50:C3:21:1F:71
*
* MD5: 0E:89:91:AC:40:50:F7:BE:6E:7B:39:4F:56:73:75:75
*
* SHA1: DC:D9:F7:AF:E2:83:10:B2:F7:0A:77:E8:50:E2:F7:D1:15:9A:9D:00
Comment on lines 780 to -784
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Make a new example with SHA-256, SHA-384 and SHA-512?

* </pre>
*/
public static String getFingerPrints(Certificate cert)
throws NoSuchAlgorithmException, CertificateEncodingException {
byte certDer[] = cert.getEncoded();
/*
String[] hashes = new String[] {"MD2", "MD5", "SHA1"};
String[] hashes = new String[] {"MD2", "MD5"};
Comment on lines -791 to +789
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Drop MD2/MD5, add SHA-256, SHA-384 and SHA-512?

String certFingerprints = "";
PrettyPrintFormat pp = new PrettyPrintFormat(":");

Expand All @@ -806,26 +804,24 @@ public static String getFingerPrints(Certificate cert)

/**
* Returns a string that has the certificate's fingerprint using
* MD5, MD2 and SHA1 hashes.
* MD5 and MD2 hashes.
Comment on lines -809 to +807
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Drop MD2/MD5, add SHA-256, SHA-384 and SHA-512?

* A certificate's fingerprint is a hash digest of the DER encoded
* certificate.
*
* @param certDer Certificate to get the fingerprints of.
* @return a String with fingerprints using the MD5, MD2 and SHA1 hashes.
* @return a String with fingerprints using the MD5 and MD2 hashes.
Comment on lines -814 to +812
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Drop MD2/MD5, add SHA-256, SHA-384 and SHA-512?

* For example,
*
* <pre>
* MD2: 78:7E:D1:F9:3E:AF:50:18:68:A7:29:50:C3:21:1F:71
*
* MD5: 0E:89:91:AC:40:50:F7:BE:6E:7B:39:4F:56:73:75:75
*
* SHA1: DC:D9:F7:AF:E2:83:10:B2:F7:0A:77:E8:50:E2:F7:D1:15:9A:9D:00
Comment on lines 816 to -822
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Make a new example with SHA-256, SHA-384 and SHA-512?

* </pre>
*/
public static String getFingerPrints(byte[] certDer)
throws NoSuchAlgorithmException/*, CertificateEncodingException*/{
// byte certDer[] = cert.getEncoded();
String[] hashes = new String[] { "MD2", "MD5", "SHA1", "SHA256", "SHA512" };
String[] hashes = new String[] { "MD2", "MD5", "SHA256", "SHA512" };
Comment on lines -828 to +824
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Drop MD2/MD5, add SHA-256, SHA-384 and SHA-512?

StringBuffer certFingerprints = new StringBuffer();
PrettyPrintFormat pp = new PrettyPrintFormat(":");

Expand Down
16 changes: 0 additions & 16 deletions base/tools/src/main/native/p12tool/secutil.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2589,22 +2589,6 @@ SECU_PrintFingerprints(FILE *out, SECItem *derCert, char *m, int level)
if (rv != SECSuccess && !err)
err = PORT_GetError();

/* print SHA1 fingerprint */
memset(fingerprint, 0, sizeof fingerprint);
rv = PK11_HashBuf(SEC_OID_SHA1, fingerprint, derCert->data, derCert->len);
fpItem.data = fingerprint;
fpItem.len = SHA1_LENGTH;
fpStr = CERT_Hexify(&fpItem, 1);
SECU_Indent(out, level);
fprintf(out, "%s (SHA1):", m);
if (SECU_GetWrapEnabled()) {
fprintf(out, "\n");
SECU_Indent(out, level + 1);
} else {
fprintf(out, " ");
}
fprintf(out, "%s\n", fpStr);
PORT_Free(fpStr);
if (SECU_GetWrapEnabled())
fprintf(out, "\n");

Expand Down
2 changes: 1 addition & 1 deletion base/tools/src/main/native/p12tool/secutil.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -245,7 +245,7 @@ extern void SECU_PrintRSAPublicKey(FILE *out, SECKEYPublicKey *pk, char *m, int
/* Dump contents of a DSA public key */
extern void SECU_PrintDSAPublicKey(FILE *out, SECKEYPublicKey *pk, char *m, int level);

/* Print the MD5 and SHA1 fingerprints of a cert */
/* Print the SHA-256 fingerprint of a cert */
extern int SECU_PrintFingerprints(FILE *out, SECItem *derCert, char *m,
int level);

Expand Down
9 changes: 0 additions & 9 deletions base/tools/src/main/native/p7tool/secutil.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2438,15 +2438,6 @@ SECU_PrintFingerprints(FILE *out, SECItem *derCert, const char *m, int level)
if (rv != SECSuccess && !err)
err = PORT_GetError();

/* print SHA1 fingerprint */
memset(fingerprint, 0, sizeof fingerprint);
rv = PK11_HashBuf(SEC_OID_SHA1,fingerprint, derCert->data, derCert->len);
fpItem.data = fingerprint;
fpItem.len = SHA1_LENGTH;
fpStr = CERT_Hexify(&fpItem, 1);
SECU_Indent(out, level); fprintf(out, "%s (SHA1):\n", m);
SECU_Indent(out, level+1); fprintf(out, "%s\n", fpStr);
PORT_Free(fpStr);
fprintf(out, "\n");

if (err)
Expand Down
2 changes: 1 addition & 1 deletion base/tools/src/main/native/p7tool/secutil.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -260,7 +260,7 @@ extern int SECU_PrintPublicKey(FILE *out, SECItem *der, const char *m, int level
extern int SECU_PrintPrivateKey(FILE *out, SECItem *der, char *m, int level);
#endif

/* Print the MD5 and SHA1 fingerprints of a cert */
/* Print the MD5 fingerprint of a cert */
extern int SECU_PrintFingerprints(FILE *out, SECItem *derCert, const char *m,
int level);

Expand Down
2 changes: 1 addition & 1 deletion base/tools/src/main/native/pistool/include/secutil.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -260,7 +260,7 @@ extern int SECU_PrintPublicKey(FILE *out, SECItem *der, char *m, int level);
extern int SECU_PrintPrivateKey(FILE *out, SECItem *der, char *m, int level);
#endif

/* Print the MD5 and SHA1 fingerprints of a cert */
/* Print the MD5 fingerprint of a cert */
extern int SECU_PrintFingerprints(FILE *out, SECItem *derCert, char *m,
int level);

Expand Down
9 changes: 0 additions & 9 deletions base/tools/src/main/native/pistool/src/secutil.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2434,15 +2434,6 @@ SECU_PrintFingerprints(FILE *out, SECItem *derCert, char *m, int level)
if (rv != SECSuccess && !err)
err = PORT_GetError();

/* print SHA1 fingerprint */
memset(fingerprint, 0, sizeof fingerprint);
rv = PK11_HashBuf(SEC_OID_SHA1,fingerprint, derCert->data, derCert->len);
fpItem.data = fingerprint;
fpItem.len = SHA1_LENGTH;
fpStr = CERT_Hexify(&fpItem, 1);
SECU_Indent(out, level); fprintf(out, "%s (SHA1):\n", m);
SECU_Indent(out, level+1); fprintf(out, "%s\n", fpStr);
PORT_Free(fpStr);
fprintf(out, "\n");

if (err)
Expand Down
9 changes: 0 additions & 9 deletions base/tools/src/main/native/tkstool/secutil.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2436,15 +2436,6 @@ SECU_PrintFingerprints(FILE *out, SECItem *derCert, const char *m, int level)
if (rv != SECSuccess && !err)
err = PORT_GetError();

/* print SHA1 fingerprint */
memset(fingerprint, 0, sizeof fingerprint);
rv = PK11_HashBuf(SEC_OID_SHA1,fingerprint, derCert->data, derCert->len);
fpItem.data = fingerprint;
fpItem.len = SHA1_LENGTH;
fpStr = CERT_Hexify(&fpItem, 1);
SECU_Indent(out, level); fprintf(out, "%s (SHA1):\n", m);
SECU_Indent(out, level+1); fprintf(out, "%s\n", fpStr);
PORT_Free(fpStr);
fprintf(out, "\n");

if (err)
Expand Down
2 changes: 1 addition & 1 deletion base/tools/src/main/native/tkstool/secutil.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -260,7 +260,7 @@ extern int SECU_PrintPublicKey(FILE *out, SECItem *der, char *m, int level);
extern int SECU_PrintPrivateKey(FILE *out, SECItem *der, char *m, int level);
#endif

/* Print the MD5 and SHA1 fingerprints of a cert */
/* Print the MD5 fingerprint of a cert */
extern int SECU_PrintFingerprints(FILE *out, SECItem *derCert, const char *m,
int level);

Expand Down