API: sha256 should be used to fingerprint for x509 keypair
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| OpenStack Compute (nova) |
Confirmed
|
Low
|
Unassigned | ||
Bug Description
Liberty is using sha1 to calculate the fingerprint returned by os-keypairs REST API calls when the key type is x509. Unlike ssh, there is no standard hash algorithm that should necessarily be used for X.509, which makes it necessary to clarify what hash was used. There is also concern in simply documenting that this is sha1 and moving on... SHA-1 is known to be flawed and everyone is moving away from it. E.g. in Mozilla you will now see both SHA-1 and SHA-256 fingerprints when you view a certificate, and they will eventually stop showing SHA-1. The nova API should be thinking forward and
1. allow the admin to configure one or more algorithms to use for x.509 fingerprints (as noted, browsers will generally display at least 2).
2. be clear in what hash algorithms are used, both in documentation and (for client's sake) in the response.
Found in Liberty.
| tags: | added: api |
| Changed in nova: | |
| status: | New → Confirmed |
| Mark Doffman (mjdoffma) wrote | #1 |
| Matthew Edmonds (edmondsw) wrote | #2 |
| Changed in nova: | |
| importance: | Undecided → Low |
| summary: |
- sha1 fingerprint for x509 keypair + API: sha256 should be used to fingerprint for x509 keypair |
| Changed in nova: | |
| assignee: | nobody → mrthegreat (mrthegreat) |
| status: | Confirmed → In Progress |
| mrthegreat (mrthegreat) wrote | #3 |
| Markus Zoeller (markus_z) (mzoeller) wrote | #4 |
| Changed in nova: | |
| assignee: | mrthegreat (mrthegreat) → nobody |
| Augustina Ragwitz (auggy) wrote | #5 |
| Changed in nova: | |
| status: | In Progress → Triaged |
| status: | Triaged → Confirmed |
| Sean Dague (sdague) wrote | #6 |
| tags: | added: openstack-version.liberty |
| Andrey Volkov (avolkov) wrote | #7 |
| tags: | removed: openstack-version.liberty |
Crypto is currently using MD5 for ssh key fingerprint and sha1 for x509 fingerprints. I can't find this documented anywhere, it probably should be. As stated in the bug, would it be best to document the hash algorithm used in the fingerprint field?
Adding more fingerprint types to the keypairs is a possibility in the future. I'm not sure how urgent it is though, given that sha-1 is still in use for fingerprints.