generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

For more than 160 bits of security disable SHA1 HMAC

Browse Source
This commit is contained in:
Dr. Stephen Henson 2014-04-05 13:39:35 +01:00
parent b7e46a9bce
commit f8dd55bb5b
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
ssl/ssl_cert.c
View File

@ -1411,6 +1411,9 @@ static int ssl_security_default_callback(SSL *s, SSL_CTX *ctx, int op, int bits,
/* No MD5 mac ciphersuites */
if (c->algorithm_mac & SSL_MD5)
return 0;
/* SHA1 HMAC is 160 bits of security */
if (minbits > 160 && c->algorithm_mac & SSL_SHA1)
return 0;
/* Level 2: no RC4 */
if (level >= 2 && c->algorithm_enc == SSL_RC4)
return 0;