Add support for more digest algorithms#188
Conversation
|
Still TODO:
|
KiOui
force-pushed
the
feature/add-support-for-more-digest-algorithms
branch
2 times, most recently
from
243e772 to
89fa2e1
Compare
This commit adds support for more digest algorithms including ECDSA, DSA, and Edwards-curves. It also switches the crypto library used from OpenSSL to cryptography. Fixes openwisp#118
KiOui
force-pushed
the
feature/add-support-for-more-digest-algorithms
branch
from
89fa2e1 to
db92060
Compare
KiOui
force-pushed
the
feature/add-support-for-more-digest-algorithms
branch
from
db92060 to
6609a74
Compare
| ("dsaWithSHA256", "SHA256 with DSA signature"), | ||
| ( | ||
| "Ed25519", | ||
| "Edwards-Curve Digital Signature Algorithm with 25519 curve", |
There was a problem hiding this comment.
@stktyagi what do you think of adding support for these 2?
Any other modern algo mentioned here that we're not supporting and would be good to have?
There was a problem hiding this comment.
I researched Ed25519 and it offers better security and performance than RSA or ECDSA curves. Its also resilient against side-channel attacks. The only issue is legacy operating systems (like Windows Server 2012 or older) may not recognize Ed25519 certificates but I don't think that's a deal breaker. What do you think?
As you mentioned in the chat, DSA is deprecated but it sits in a bit of a gray area as it improves upon the original DSA by swapping out the broken SHA1 for the secure SHA256 but overall I won't prefer it.
So, overall Ed25519 would be a good addition and also RSASSA-PSS as it fixes traditional RSA's weakness of being deterministic making it vulnerable to certain padding oracle attacks.
There was a problem hiding this comment.
@stktyagi yeah I think supporting one or both shouldn't change much, it would be great to support more options and help more users use this reusable app
3 participants
Checklist
Reference to Existing Issue
Closes #118.
Please open a new issue if there isn't an existing issue yet.
Description of Changes
This PR add support for more digest algorithms (other than RSA). It also switches most cryptographic operations to the
cryptographylibrary (instead of OpenSSL).Please describe these changes.
Screenshot
Please include any relevant screenshots.