crypto/x509: replace MD5 in PEM encryption?

[micahhyman1]

The deriveKey function in crypto/x509 uses an md5 hash to derive the encryption key. This hash is out-of-date, insecure and non FIPS compliant. It should be replaced with sha-256.

[FiloSottile]

That's not a change we can make unilaterally. It would make it impossible to decrypt PEM files encrypted by OpenSSL or by previous versions of Go.

Thankfully, it's not being used as a collision-resistant hash, but as a key derivation function, and MD5 is not broken for that purpose.

I will look into the spec to see if there's anything we can change.

[micahhyman1]

Could it be made an option on the encryption function to choose which hash is used, the same way one can choose which cipher to use?

[lucasmoten]

I think that could be added as additional convenience functions in crypto/x509/pem_decrypt.go.
Similar to how openssl extended to support password based key derivation function. Theoretically, the current implementation of DecryptPEMBlock wouldn't work with a cert encrypted via
openssl enc -aes-256-cbc -md sha512 -pbkdf2 -iter 1000 -salt -in plaintext.pem -out encrypted.pem
Establishing additional functions that support the inputs openssl offers for specifying message digest and iteration count etc would be an improvement.

[gopherbot]

Change https://golang.org/cl/264159 mentions this issue: crypto/x509: deprecate legacy PEM encryption