Removing obsolete encryption arguments #907
Conversation
lidiazuin
changed the title
|
Looks like you've updated the documentation! Check out your changes at https://neo4j-docs-operations-907.surge.sh |
| * `-v2 aes-128-cbc -v2prf hmacWithSHA256` | ||
| * `-v2 aes-128-cbc -v2prf hmacWithSHA384` | ||
| * `-v2 aes-128-cbc -v2prf hmacWithSHA512` | ||
| * `-v2 aes-256-cbc -v2prf hmacWithSHA1` |
There was a problem hiding this comment.
I think hmacWithSHA1 is still ok for some usecases. Maybe we can keep it with a caveat?
There was a problem hiding this comment.
Like, use carefully, the secrecy of the key is paramount, be sure that your use case doesn't rely on collision resistance etc.
Or maybe we should just follow NIST advice and not mention it, you are right. :)
There was a problem hiding this comment.
I was thinking it would be better to just remove them at all and keep only the ones that are the safest. But in case there's any occasion where hmacWithSHA1 is mandatory or the most logical option, we can bring it back and leave a note? Also, is this valid for all versions of Neo4j?
There was a problem hiding this comment.
Yes, it is for all the versions. You are right, let's remove it and see if anyone asks for it!
No description provided.