Skip to content

Removing obsolete encryption arguments #907

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jul 18, 2023
Merged

Removing obsolete encryption arguments #907

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 0 additions & 10 deletions modules/ROOT/pages/security/ssl-framework.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -169,26 +169,16 @@ openssl pkcs8 -topk8 -v2 aes-256-cbc -v2prf hmacWithSHA512 -in pkcs1or8.key -out
----

.Supported encryption arguments to openssl are:
* `-v1 PBE-MD5-DES`
* `-v1 PBE-SHA1-3DES`
* `-v1 PBE-SHA1-RC2-40`
* `-v1 PBE-SHA1-RC2-128`
* `-v1 PBE-SHA1-RC4-40`
* `-v1 PBE-SHA1-RC4-128`
* `-v1 PBE-SHA1-2DES`
* `-v2 aes-128-cbc -v2prf hmacWithSHA1`
* `-v2 aes-128-cbc -v2prf hmacWithSHA224`
* `-v2 aes-128-cbc -v2prf hmacWithSHA256`
* `-v2 aes-128-cbc -v2prf hmacWithSHA384`
* `-v2 aes-128-cbc -v2prf hmacWithSHA512`
* `-v2 aes-256-cbc -v2prf hmacWithSHA1`
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think hmacWithSHA1 is still ok for some usecases. Maybe we can keep it with a caveat?

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Like, use carefully, the secrecy of the key is paramount, be sure that your use case doesn't rely on collision resistance etc.

Or maybe we should just follow NIST advice and not mention it, you are right. :)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was thinking it would be better to just remove them at all and keep only the ones that are the safest. But in case there's any occasion where hmacWithSHA1 is mandatory or the most logical option, we can bring it back and leave a note? Also, is this valid for all versions of Neo4j?

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, it is for all the versions. You are right, let's remove it and see if anyone asks for it!

* `-v2 aes-256-cbc -v2prf hmacWithSHA224`
* `-v2 aes-256-cbc -v2prf hmacWithSHA256`
* `-v2 aes-256-cbc -v2prf hmacWithSHA384`
* `-v2 aes-256-cbc -v2prf hmacWithSHA512`

It is highly recommended to use one of the `-v2` variants, because they offer more robust encryption.

[NOTE]
====
Versions before Neo4j 5.0 allow keys to be stored with the old PKCS #1 standard.
Expand Down