Re: [Firebird-devel] Fwd: [FB-Tracker] Commented: (CORE-5788) Proposed Security Patch: Replacement of use of SHA-1 in the SRP Client Proof with SHA-256

2018-06-23 Thread Mark Rotteveel
On 21-6-2018 14:07, Alex Peshkoff via Firebird-devel wrote: I've forwarded this FYI to devel & admin.     [ http://tracker.firebirdsql.org/browse/CORE-5788?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=33942#action_33942 ] Status of Srp256 plugin in FB3 & FB4. In

Re: [Firebird-devel] Fwd: [FB-Tracker] Commented: (CORE-5788) Proposed Security Patch: Replacement of use of SHA-1 in the SRP Client Proof with SHA-256

2018-06-21 Thread Mark Rotteveel
On 21-6-2018 16:20, Tony Whyman wrote: Be careful: if you set the ClientAuth to Srp,Srp256 and the ServerAuth is Srp256,Srp, then you will always use SHA-1 to generate the client proof and you get no benefit from the patch. Ideally the client is Srp256 only, with Srp256,Srp to allow for

Re: [Firebird-devel] Fwd: [FB-Tracker] Commented: (CORE-5788) Proposed Security Patch: Replacement of use of SHA-1 in the SRP Client Proof with SHA-256

2018-06-21 Thread Mark Rotteveel
On 21-6-2018 15:57, Alex Peshkoff via Firebird-devel wrote: On 21.06.2018 16:36, Mark Rotteveel wrote: That is everything continues to use SHA-1, except the generating of M itself. As far as I can see - yes. The only detail that you need to support both cases depending upon plugin name.

Re: [Firebird-devel] Fwd: [FB-Tracker] Commented: (CORE-5788) Proposed Security Patch: Replacement of use of SHA-1 in the SRP Client Proof with SHA-256

2018-06-21 Thread Alex Peshkoff via Firebird-devel
On 21.06.2018 16:36, Mark Rotteveel wrote: On 21-6-2018 14:07, Alex Peshkoff via Firebird-devel wrote: I've forwarded this FYI to devel & admin. [ http://tracker.firebirdsql.org/browse/CORE-5788?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=33942#action_33942 ]

Re: [Firebird-devel] Fwd: [FB-Tracker] Commented: (CORE-5788) Proposed Security Patch: Replacement of use of SHA-1 in the SRP Client Proof with SHA-256

2018-06-21 Thread Mark Rotteveel
On 21-6-2018 14:07, Alex Peshkoff via Firebird-devel wrote: I've forwarded this FYI to devel & admin.     [ http://tracker.firebirdsql.org/browse/CORE-5788?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=33942#action_33942 ] Status of Srp256 plugin in FB3 & FB4. In

[Firebird-devel] Fwd: [FB-Tracker] Commented: (CORE-5788) Proposed Security Patch: Replacement of use of SHA-1 in the SRP Client Proof with SHA-256

2018-06-21 Thread Alex Peshkoff via Firebird-devel
I've forwarded this FYI to devel & admin. [ http://tracker.firebirdsql.org/browse/CORE-5788?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=33942#action_33942 ] Status of Srp256 plugin in FB3 & FB4. In master branch Srp256 (with enhanced security) becomes single