-
Notifications
You must be signed in to change notification settings - Fork 0
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[PW_SID:793265] eap-mschapv2: allow using on kernels without CRYPTO_MD4, and deprecate #241
base: workflow
Are you sure you want to change the base?
Conversation
This is taken care of by the individual cache items and if none exist, tar fails.
Currently eap-mschapv2 does kernel MD4 check during init time, even though it is possible to use it with Password-Hash on kernels without MD4. Separately, mschapv2 is obsolete, deprecated, and removed even in Windows 11 22H2 [1][2]. Add an error message stating so encouraging migration to PEAP-TLS or EAP-TLS. Separately, warnings like these often don't work, thus likely need to remove this authentication method completely. IWD usage of MD4 was brought up on linux-crypto mailing list [3], upon my attempt to remove CRYPTO_MD4 from the kernel which is no longer used via crypto API by anything else. It worries me that internet searches suggest that EDUROAM (a Wi-FI network spanning 106 territories) seems to still often use mschapv2. Thus dropping this support may leave millions of people without connectivity. Given how broken and isecure this authentication method has been since 2012, I hope that EDUROAM is migrating, or has migrated to P/EAP-TLS. [1] https://learn.microsoft.com/en-us/security-updates/securityadvisories/2012/2743314 [2] https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/considerations-known-issues [3] https://lore.kernel.org/linux-crypto/2e52c8b4-e70a-453f-853a-1962c8167dfa@gmail.com/
Fetch PR Make Distcheck Output:
Build - Configure Make Check Output:
Make Check w/Valgrind Output:
Incremental Build with patches |
Fetch PR GitLint Output:
Make Distcheck Output:
Build - Configure Make Check Output:
Make Check w/Valgrind Output:
Incremental Build with patches Autotest Runner Output:
Clang Build Output:
|
c94e205
to
0505d54
Compare
a9a4ef7
to
eac1598
Compare
bcfe88e
to
d7f439f
Compare
d7f439f
to
92a4b1e
Compare
61cb7e5
to
ede3c3a
Compare
8991f76
to
ca0eb77
Compare
aada677
to
1163d8b
Compare
cd38a46
to
a84ea46
Compare
9ef1a07
to
b2ed861
Compare
0375753
to
7e9a794
Compare
d961fcd
to
bd89ecb
Compare
Currently eap-mschapv2 does kernel MD4 check during init time, even
though it is possible to use it with Password-Hash on kernels without
MD4.
Separately, mschapv2 is obsolete, deprecated, and removed even in
Windows 11 22H2 [1][2]. Add an error message stating so encouraging
migration to PEAP-TLS or EAP-TLS. Separately, warnings like these often
don't work, thus likely need to remove this authentication method
completely.
IWD usage of MD4 was brought up on linux-crypto mailing list [3], upon
my attempt to remove CRYPTO_MD4 from the kernel which is no longer used
via crypto API by anything else.
It worries me that internet searches suggest that EDUROAM (a Wi-FI
network spanning 106 territories) seems to still often use
mschapv2. Thus dropping this support may leave millions of people
without connectivity. Given how broken and isecure this authentication
method has been since 2012, I hope that EDUROAM is migrating, or has
migrated to P/EAP-TLS.
[1] https://learn.microsoft.com/en-us/security-updates/securityadvisories/2012/2743314
[2] https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/considerations-known-issues
[3] https://lore.kernel.org/linux-crypto/2e52c8b4-e70a-453f-853a-1962c8167dfa@gmail.com/
src/eap-mschapv2.c | 17 +++++++++--------
1 file changed, 9 insertions(+), 8 deletions(-)