search

turtl / tracker

This project is for tracking issues, bug reports, and progress on the entire Turtl project.
67 stars 3 forks source link

OpenSSL 1.0, 1.1 EOL #424

Open ShamrockLee opened 1 year ago

ShamrockLee commented 1 year ago

OpenSSL 1.0 is already deprecated, an 1.1 is going to hit its end of life at 2023-09-11. Upgrade OpenSSL to at least 1.2 is necessary as a security-oriented software project.

wakearray commented 11 months ago

All versions of OpenSSL prior to OpenSSL 3.0 LTS are EOL. OpenSSL 3.0 LTS will be supported till 07 Sep 2026 or we could go with 3.1 and it will be supported till 14 Mar 2025 at which point we will need to upgrade to whatever version replaces it.

Currently, the most recent FIPS-validated release is 3.0.8, but as this isn't an application certified for government, medical, or financial use, it's probably best to just go with the most recent LTS release, currently 3.0.12.

There's quite a significant amount of changes between 1.x and 3.x so before even looking at the specific encryption implementation (I'm very new to Rust), I can say this may not be a quick and easy upgrade.

Breaking changes between OpenSSL 1.0.2 and 1.1.1 can be found here: https://wiki.openssl.org/index.php/OpenSSL_1.1.0_Changes

Breaking changes between OpenSSL 1.1.1 and 3.0/3.1 can be found here: https://www.openssl.org/docs/man3.1/man7/migration_guide.html#Upgrading-from-OpenSSL-1.1.1