diff options
| author | Filippo Valsorda <filippo@golang.org> | 2025-03-15 15:12:39 +0100 |
|---|---|---|
| committer | Gopher Robot <gobot@golang.org> | 2025-05-21 15:09:29 -0700 |
| commit | 59211acb5dbde14647e025eb7379675debcf3930 (patch) | |
| tree | db98ad31b32d59f381e701cadda32590233d096c /doc/godebug.md | |
| parent | 4158ca8d7c521aee5cc48f285f559e74845e973c (diff) | |
| download | go-59211acb5dbde14647e025eb7379675debcf3930.tar.xz | |
crypto/tls: disable SHA-1 signature algorithms in TLS 1.2
This implements RFC 9155 by removing support for SHA-1 algorithms:
- we don't advertise them in ClientHello and CertificateRequest
(where supportedSignatureAlgorithms is used directly)
- we don't select them in our ServerKeyExchange and CertificateVerify
(where supportedSignatureAlgorithms filters signatureSchemesForCertificate)
- we reject them in the peer's ServerKeyExchange and CertificateVerify
(where we check against the algorithms we advertised in ClientHello
and CertificateRequest)
Fixes #72883
Change-Id: I6a6a4656e2aafd2c38cdd32090d3d8a9a8047818
Reviewed-on: https://go-review.googlesource.com/c/go/+/658216
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
Reviewed-by: David Chase <drchase@google.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>
Reviewed-by: Daniel McCarney <daniel@binaryparadox.net>
Diffstat (limited to 'doc/godebug.md')
| -rw-r--r-- | doc/godebug.md | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/doc/godebug.md b/doc/godebug.md index b0c820da46..3b8c62a46c 100644 --- a/doc/godebug.md +++ b/doc/godebug.md @@ -180,6 +180,9 @@ runtime will periodically update GOMAXPROCS for new CPU affinity or cgroup limits. The default value `updatemaxprocs=1` will enable periodic updates. `updatemaxprocs=0` will disable periodic updates. +Go 1.25 disabled SHA-1 signature algorithms in TLS 1.2 according to RFC 9155. +The default can be reverted using the `tlssha1=1` setting. + Go 1.25 corrected the semantics of contention reports for runtime-internal locks, and so removed the [`runtimecontentionstacks` setting](/pkg/runtime#hdr-Environment_Variable). |