self-hosted/minio
self-hosted/minio
1
0
Fork 0
mirror of https://github.com/minio/minio synced 2024-09-06 00:37:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: allow P-384/P-512 constant time implementation (#15445)

Browse source 
since go1.18.x P-384/P-512 are now constant time
implementations, enable them.
This commit is contained in:
Harshavardhana 2022-08-01 09:27:16 -07:00 committed by GitHub
parent 10b49eb4fb
commit fd349103e8
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 0 additions and 17 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
docs/tls/README.md
View file

@ -86,8 +86,6 @@ Alternatively, use the following command to generate a private ECDSA key protect
openssl ecparam -genkey -name prime256v1 | openssl ec -aes256 -out private.key -passout pass:PASSWORD
```
**Note:** NIST curves P-384 and P-521 are not currently supported.
#### 3.2.2 Generate a private key with RSA
Use the following command to generate a private key with RSA:

15
internal/config/certs.go
View file

@ -19,8 +19,6 @@ package config
import (
"bytes"
"crypto"
"crypto/ecdsa"
"crypto/tls"
"crypto/x509"
"encoding/pem"
@ -103,19 +101,6 @@ func LoadX509KeyPair(certFile, keyFile string) (tls.Certificate, error) {
if err != nil {
return tls.Certificate{}, ErrSSLUnexpectedData(nil).Msg(err.Error())
}
// Ensure that the private key is not a P-384 or P-521 EC key.
// The Go TLS stack does not provide constant-time implementations of P-384 and P-521.
if priv, ok := cert.PrivateKey.(crypto.Signer); ok {
if pub, ok := priv.Public().(*ecdsa.PublicKey); ok {
switch pub.Params().Name {
case "P-384":
fallthrough
case "P-521":
// unfortunately there is no cleaner way to check
return tls.Certificate{}, ErrSSLUnexpectedData(nil).Msg("tls: the ECDSA curve '%s' is not supported", pub.Params().Name)
}
}
}
return cert, nil
}