Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove X509PurposeId::NS_SSL_SERVER API, from the SSL 2.0 era #2136

Open
davidben opened this issue Dec 26, 2023 · 0 comments
Open

Remove X509PurposeId::NS_SSL_SERVER API, from the SSL 2.0 era #2136

davidben opened this issue Dec 26, 2023 · 0 comments

Comments

@davidben
Copy link
Contributor

rust-openssl still carries some remnants of SSL 2.0. X509PurposeId::NS_SSL_SERVER corresponds to X509_PURPOSE_NS_SSL_SERVER, which mandates the keyEncipher key usage bit.

TLS from the last decade uses the digitalSignature bit, because we use the credential for signing, not encryption. keyEncipherment is used by the legacy RSA key exchange mode. As early as SSL 3.0, we had signing-based cipher suites in the form of DHE_RSA. Only SSL 2.0 was encryption-only.

As SSL 2.0 is broken. rust-openssl really shouldn't be carrying remnants of it anymore, or depending on X.509 APIs to do so.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant