Skip to content

context: deprecate support for encrypted TLS private keys - #3218

Merged
silvin-lubecki merged 1 commit into
docker:masterfrom
thaJeztah:deprecate_encrypted_tls
Jul 28, 2021
Merged

context: deprecate support for encrypted TLS private keys#3218
silvin-lubecki merged 1 commit into
docker:masterfrom
thaJeztah:deprecate_encrypted_tls

Conversation

@thaJeztah

Copy link
Copy Markdown
Member

relates to #3212
follow-up to #3213

Legacy PEM encryption as specified in RFC 1423 is insecure by design. Since
it does not authenticate the ciphertext, it is vulnerable to padding oracle
attacks that can let an attacker recover the plaintext

From https://go-review.googlesource.com/c/go/+/264159

It's unfortunate that we don't implement PKCS#8 encryption so we can't
recommend an alternative but PEM encryption is so broken that it's worth
deprecating outright.

- Description for the changelog

- A picture of a cute animal (not mandatory but encouraged)

@silvin-lubeckisilvin-lubecki left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@silvin-lubecki

Copy link
Copy Markdown
Contributor

@thaJeztah this PR needs to be rebased on top of main to remove the lint errors 🙏

@thaJeztah

Copy link
Copy Markdown
MemberAuthor

oh! 🤦 no it's because I deprecated the TLSPassword field, and we still use it, so need to add another //nolint

cli/command/cli.go:258:5: SA1019: cli.dockerEndpoint.TLSPassword is deprecated: Use of encrypted TLS private keys has been deprecated, and will be removed in a future release. Golang has deprecated support for legacy PEM encryption (as specified in RFC 1423), as it is insecure by design (see https://go-review.googlesource.com/c/go/+/264159). (staticcheck)
cli.dockerEndpoint.TLSPassword = password
^

> Legacy PEM encryption as specified in RFC 1423 is insecure by design. Since
> it does not authenticate the ciphertext, it is vulnerable to padding oracle
> attacks that can let an attacker recover the plaintext
From https://go-review.googlesource.com/c/go/+/264159
> It's unfortunate that we don't implement PKCS#8 encryption so we can't
> recommend an alternative but PEM encryption is so broken that it's worth
> deprecating outright.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
@thaJeztah
thaJeztahforce-pushed the deprecate_encrypted_tls branch from 1808046 to 15535d4CompareJuly 28, 2021 12:42
@codecov-commenter

Copy link
Copy Markdown

Codecov Report

Merging #3218 (15535d4) into master (fb78bd4) will decrease coverage by 0.00%.
The diff coverage is 0.00%.

@@ Coverage Diff @@## master #3218 +/- ##
==========================================
- Coverage 58.58% 58.57% -0.01% 
==========================================
Files 299 299 Lines 21502 21502 ==========================================
- Hits 12597 12595 -2 - Misses 7983 7984 +1 - Partials 922 923 +1 

@thaJeztah

Copy link
Copy Markdown
MemberAuthor

Whoop; it's green now @silvin-lubecki ptal

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@thaJeztah@silvin-lubecki@codecov-commenter