Re: pkinit broken in 1.5 against heimdal-kdc 1.2
Guido Günther <[email protected]>
| Newsgroups | gmane.comp.encryption.kerberos.heimdal.general |
|---|---|
| Message-ID | <[email protected]> |
Hi Love, On Sun, Dec 18, 2011 at 02:03:09AM +0000, Love Hörnquist Åstrand wrote: > Hello, > > Can you try changing the variables > > _hx509_crypto_default_ > > in lib/hx509/crypto.c to use sha1 instead of sha256 ? Thanks for the hint. That alone didn't help but moving up the sha1 in the list of signature algorithms did (see attached patch). Can we somehow autodetect old KDCs to force this behaviour? Cheers, -- Guido
Use-sha1-instead-of-sha256.patch
(text/x-diff, 1.4 KB)
From: =?UTF-8?q?Guido=20G=C3=BCnther?= <[email protected]> Date: Sun, 18 Dec 2011 13:26:45 +0100 Subject: Use sha1 instead of sha256 --- lib/hx509/crypto.c | 10 +++++----- 1 files changed, 5 insertions(+), 5 deletions(-) diff --git a/lib/hx509/crypto.c b/lib/hx509/crypto.c index 4559a9c..17513d8 100644 --- a/lib/hx509/crypto.c +++ b/lib/hx509/crypto.c @@ -1448,6 +1448,9 @@ static const struct signature_alg md5_alg = { */ static const struct signature_alg *sig_algs[] = { + &rsa_with_sha1_alg, + &rsa_with_sha1_alg_secsig, + &pkcs1_rsa_sha1_alg, #ifdef HAVE_OPENSSL &ecdsa_with_sha256_alg, &ecdsa_with_sha1_alg, @@ -1455,9 +1458,6 @@ static const struct signature_alg *sig_algs[] = { &rsa_with_sha512_alg, &rsa_with_sha384_alg, &rsa_with_sha256_alg, - &rsa_with_sha1_alg, - &rsa_with_sha1_alg_secsig, - &pkcs1_rsa_sha1_alg, &rsa_with_md5_alg, &heim_rsa_pkcs1_x509, &dsa_sha1_alg, @@ -1979,9 +1979,9 @@ hx509_crypto_aes256_cbc(void) */ const AlgorithmIdentifier * _hx509_crypto_default_sig_alg = - &_hx509_signature_rsa_with_sha256_data; + &_hx509_signature_rsa_with_sha1_data; const AlgorithmIdentifier * _hx509_crypto_default_digest_alg = - &_hx509_signature_sha256_data; + &_hx509_signature_sha1_data; const AlgorithmIdentifier * _hx509_crypto_default_secret_alg = &_hx509_crypto_aes128_cbc_data;