IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-24 16:10:02 -06:00
Code Issues Packages Projects Releases Wiki Activity

Use RSA-OAEP instead of RSA PKCS#1 v1.5

Browse Source 
jwcrypto's RSA1-5 (PKCS#1 v1.5) is vulnerable to padding oracle
side-channel attacks. OAEP (PKCS#1 v2.0) is a safe, more modern
alternative.

https://fedorahosted.org/freeipa/ticket/6278

Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Martin Basti <mbasti@redhat.com>
This commit is contained in:
Christian Heimes 2016-09-05 15:38:48 +02:00 committed by Martin Basti
parent a3d178b86d
commit 4ae4d0d690
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ipapython/secrets/client.py
View File

@ -86,7 +86,7 @@ class CustodiaClient(object):
url = 'https://%s/ipa/keys/%s' % (self.server, keyname) url = 'https://%s/ipa/keys/%s' % (self.server, keyname)
# Prepare signed/encrypted request # Prepare signed/encrypted request
encalg = ('RSA1_5', 'A256CBC-HS512') encalg = ('RSA-OAEP', 'A256CBC-HS512')
request = self.kemcli.make_request(keyname, encalg=encalg) request = self.kemcli.make_request(keyname, encalg=encalg)
# Prepare Authentication header # Prepare Authentication header