diff options
| author | Filippo Valsorda <filippo@golang.org> | 2025-03-15 15:12:39 +0100 |
|---|---|---|
| committer | Gopher Robot <gobot@golang.org> | 2025-05-21 15:09:29 -0700 |
| commit | 59211acb5dbde14647e025eb7379675debcf3930 (patch) | |
| tree | db98ad31b32d59f381e701cadda32590233d096c /src/runtime | |
| parent | 4158ca8d7c521aee5cc48f285f559e74845e973c (diff) | |
| download | go-59211acb5dbde14647e025eb7379675debcf3930.tar.xz | |
crypto/tls: disable SHA-1 signature algorithms in TLS 1.2
This implements RFC 9155 by removing support for SHA-1 algorithms:
- we don't advertise them in ClientHello and CertificateRequest
(where supportedSignatureAlgorithms is used directly)
- we don't select them in our ServerKeyExchange and CertificateVerify
(where supportedSignatureAlgorithms filters signatureSchemesForCertificate)
- we reject them in the peer's ServerKeyExchange and CertificateVerify
(where we check against the algorithms we advertised in ClientHello
and CertificateRequest)
Fixes #72883
Change-Id: I6a6a4656e2aafd2c38cdd32090d3d8a9a8047818
Reviewed-on: https://go-review.googlesource.com/c/go/+/658216
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
Reviewed-by: David Chase <drchase@google.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>
Reviewed-by: Daniel McCarney <daniel@binaryparadox.net>
Diffstat (limited to 'src/runtime')
| -rw-r--r-- | src/runtime/metrics/doc.go | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/runtime/metrics/doc.go b/src/runtime/metrics/doc.go index 8204e87fd1..7ef09be2fc 100644 --- a/src/runtime/metrics/doc.go +++ b/src/runtime/metrics/doc.go @@ -350,6 +350,10 @@ Below is the full list of supported metrics, ordered lexicographically. The number of non-default behaviors executed by the crypto/tls package due to a non-default GODEBUG=tlsrsakex=... setting. + /godebug/non-default-behavior/tlssha1:events + The number of non-default behaviors executed by the crypto/tls + package due to a non-default GODEBUG=tlssha1=... setting. + /godebug/non-default-behavior/tlsunsafeekm:events The number of non-default behaviors executed by the crypto/tls package due to a non-default GODEBUG=tlsunsafeekm=... setting. |