Re: Proposal: Remove MD5 / SHA1 support from veriexec

Taylor R Campbell <[email protected]> Wed, 13 Sep 2017 21:26:55 +0000

Newsgroups	gmane.os.netbsd.devel.security
Message-ID	<[email protected]>

> Date: Tue, 22 Aug 2017 00:12:19 +0100
> From: Sevan Janiyan <[email protected]>
> 
> Hello,
> As a two part process, I propose we remove the ability to generate
> signatures using SHA1/MD5 with veriexecgen as a part of NetBSD 8.
> Then in HEAD for NetBSD 9, we remove support for these hashes from the
> remaining components & kernel configuration files.
> 
> Part 1:
> http://www.netbsd.org/~sevan/patch-veriexecgen.txt
> 
> Part 2:
> http://www.netbsd.org/~sevan/patch-veriexec-nomd5-sha1.txt
> 
> Thoughts / objections?

LGTM (including removing RMD160 at the same time)