search

libp2p / specs

Technical specifications for the libp2p networking stack
https://libp2p.io
1.56k stars 273 forks source link

[Doc] Update required for outdated link in libp2p TLS Handshake (specs/tls/tls.md) #510

Closed MuhtasimTanmoy closed 1 year ago

MuhtasimTanmoy commented 1 year ago

This doc specs/tls/tls.md contains an outdated link in the following section.

Certificates MUST use the NamedCurve encoding for elliptic curve parameters. Endpoints MUST abort the connection attempt if is not used. Failure to enforce this restriction allows “Whose Curve Is It Anyway” attacks, which completely compromise the security of the connection. Similarly, hash functions with an output length less than 256 bits MUST NOT be used, due to the possibility of collision attacks. In particular, MD5 and SHA1 MUST NOT be used.

Does it needs to be updated with link from web archive or should be removed?

mxinden commented 1 year ago

I wonder whether this paragraph is still relevant in the first place. I would expect patches to be widely deployed by now.

I would assume @marten-seemann is way more knowledgeable here. Any thoughts?

marten-seemann commented 1 year ago

This was added in https://github.com/libp2p/specs/pull/255. I don't have any strong opinions, this is something that I trust my TLS stack to handle for me :) I'd be ok with removing this paragraph.

mxinden commented 1 year ago

@MuhtasimTanmoy would you mind opening a pull request removing the paragraph?