[Bug 1455990] Re: quassel-core generates an insecure certificate upon installation
Michael Marley
michael at michaelmarley.com
Mon May 18 21:14:12 UTC 2015
While having a 4096-bit certificate is not necessary in order to be
secure, its only disadvantages are taking longer to generate (which I
don't think is much of an issue because it doesn't get regenerated very
often) and taking slightly longer for the handshake (which is
practically negligible on modern computers).
Yes, saving the md5 of the accepted certs is a bad idea. I will fix
that.
--
You received this bug notification because you are a member of Ubuntu
Sponsors Team, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/1455990
Title:
quassel-core generates an insecure certificate upon installation
Status in quassel package in Ubuntu:
New
Bug description:
After installation, quassel-core generates a 1024-bit certificate
using the SHA1 hash. Both of these are considered deprecated and
somewhat insecure. The attached patch updates the postinst script to
generate a 4096-bit certificate using the SHA256 hash instead.
The SHA256 certificate will not cause any compatibility problems
because OpenSSL 1.0.0 and later support SHA256 certificates. All
supported versions of Ubuntu and Debian have at least 1.0.1 and the
supported Windows and Mac builds of Quassel are additionally compiled
with a recent enough version to support the SHA256 certificate.
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/quassel/+bug/1455990/+subscriptions
More information about the Ubuntu-sponsors
mailing list