docs-commits September 2016

docs-commits@lists.fedoraproject.org

1 participants
1 discussions

[defensive-coding-guide] 01/01: Cryptography: Update ciphers list
by git repository hosting 09 Sep '16

09 Sep '16

This is an automated email from the git hooks/post-receive script. fweimer pushed a commit to branch master in repository defensive-coding-guide. commit 767d0ce5ef225793f91eba9db67efd39c30a1d4a Author: Florian Weimer <fweimer(a)redhat.com> Date: Fri Sep 9 09:12:00 2016 +0200 Cryptography: Update ciphers list --- en-US/Tasks-Cryptography.xml | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/en-US/Tasks-Cryptography.xml b/en-US/Tasks-Cryptography.xml index 1bafc2a..8e33007 100644 --- a/en-US/Tasks-Cryptography.xml +++ b/en-US/Tasks-Cryptography.xml @@ -11,8 +11,12 @@ recommended: </para> <itemizedlist> - <listitem><para>RSA with 2048 bit keys and OAEP</para></listitem> + <listitem><para>RSA with 2048 bit keys and OAEP or PSS + padding</para></listitem> <listitem><para>AES-128 in CBC mode</para></listitem> + <listitem><para>AES-128 in GCM mode</para></listitem> + <listitem><para>AES-256 in CBC mode</para></listitem> + <listitem><para>AES-256 in GCM mode</para></listitem> <listitem><para>SHA-256</para></listitem> <listitem><para>HMAC-SHA-256</para></listitem> <listitem><para>HMAC-SHA-1</para></listitem> @@ -25,8 +29,8 @@ <listitem><para>RSA with key sizes larger than 1024 and legacy padding</para></listitem> <listitem><para>AES-192</para></listitem> - <listitem><para>AES-256</para></listitem> - <listitem><para>3DES (triple DES, with two or three 56 bit keys)</para></listitem> + <listitem><para>3DES (triple DES, with two or three 56 bit keys), + but strongly discouraged</para></listitem> <listitem><para>RC4 (but very, very strongly discouraged)</para></listitem> <listitem><para>SHA-1</para></listitem> <listitem><para>HMAC-MD5</para></listitem> @@ -40,6 +44,13 @@ transmissions, TLS should be used (<xref linkend="chap-Defensive_Coding-TLS"/>). </para> + <para> + In particlar, when using AES in CBC mode, it is necessary to + add integrity checking by other means, preferably using + HMAC-SHA-256 and <emphasis>after</emphasis> encryption (that + is, on the encrypted cipher text). For AES in GCM mode, + correct construction of nonces is absolutely essential. + </para> </important>  -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

docs-commits September 2016