Skip to content
  • Yasuo Honda's avatar
    dd12bf32
    Use `SHA256` digest instead of `MD4` that is legacy in OpenSSL 3 · dd12bf32
    Yasuo Honda authored
    This commit updates the MD4 digest used in `MessageEncryptorsTest`
    because OpenSSL 3 moves `MD4` digests as legacy provider.
    
    https://www.openssl.org/news/openssl-3.0-notes.html
    Major changes between OpenSSL 3.0.0 and OpenSSL 3.0.1 [14 Dec 2021]
    > Moved the EVP digests MD2, MD4, MDC2, WHIRLPOOL and RIPEMD-160 to the legacy provider.
    
    Since Rails CI migrates from Debian 11 "bullseye" based Ruby 3.1 and 3.2 images
    to Debian 12 "bookworm" based ones, that supports OpenSSL 3,
    `MessageEncryptorsTest` raises `EVP_DigestSignInit: unsupported (OpenSSL::HMACError)`
    and `Digest initialization failed: initialization error (OpenSSL::Digest::DigestError)`
    
    https://packages.debian.org/bookworm/openssl
    > Package: openssl (3.0.9-1)
    
    `SHA256` is listed as `Provided:` via `openssl list -digest-algorithms` output,
    so it is safe to use `SHA256` digest in the `MessageEncryptorsTest`.
    
    ```
      { 2.16.840.1.101.3.4.2.1, SHA-256, SHA2-256, SHA256 } @ default
    ```
    
    ```
    $ openssl version
    OpenSSL 3.0.8 7 Feb 2023 (Library: OpenSSL 3.0.8 7 Feb 2023)
    $ openssl list -digest-algorithms
    Legacy:
      RSA-MD4 => MD4
      RSA-MD5 => MD5
      RSA-RIPEMD160 => RIPEMD160
      RSA-SHA1 => SHA1
      RSA-SHA1-2 => RSA-SHA1
      RSA-SHA224 => SHA224
      RSA-SHA256 => SHA256
      RSA-SHA3-224 => SHA3-224
      RSA-SHA3-256 => SHA3-256
      RSA-SHA3-384 => SHA3-384
      RSA-SHA3-512 => SHA3-512
      RSA-SHA384 => SHA384
      RSA-SHA512 => SHA512
      RSA-SHA512/224 => SHA512-224
      RSA-SHA512/256 => SHA512-256
      RSA-SM3 => SM3
      BLAKE2b512
      BLAKE2s256
      id-rsassa-pkcs1-v1_5-with-sha3-224 => SHA3-224
      id-rsassa-pkcs1-v1_5-with-sha3-256 => SHA3-256
      id-rsassa-pkcs1-v1_5-with-sha3-384 => SHA3-384
      id-rsassa-pkcs1-v1_5-with-sha3-512 => SHA3-512
      MD4
      md4WithRSAEncryption => MD4
      MD5
      MD5-SHA1
      md5WithRSAEncryption => MD5
      ripemd => RIPEMD160
      RIPEMD160
      ripemd160WithRSA => RIPEMD160
      rmd160 => RIPEMD160
      SHA1
      sha1WithRSAEncryption => SHA1
      SHA224
      sha224WithRSAEncryption => SHA224
      SHA256
      sha256WithRSAEncryption => SHA256
      SHA3-224
      SHA3-256
      SHA3-384
      SHA3-512
      SHA384
      sha384WithRSAEncryption => SHA384
      SHA512
      SHA512-224
      sha512-224WithRSAEncryption => SHA512-224
      SHA512-256
      sha512-256WithRSAEncryption => SHA512-256
      sha512WithRSAEncryption => SHA512
      SHAKE128
      SHAKE256
      SM3
      sm3WithRSAEncryption => SM3
      ssl3-md5 => MD5
      ssl3-sha1 => SHA1
      whirlpool
    Provided:
      { 2.16.840.1.101.3.4.2.10, SHA3-512 } @ default
      { 1.3.6.1.4.1.1722.12.2.2.8, BLAKE2S-256, BLAKE2s256 } @ default
      { 1.2.156.10197.1.401, SM3 } @ default
      { 2.16.840.1.101.3.4.2.8, SHA3-256 } @ default
      { 2.16.840.1.101.3.4.2.7, SHA3-224 } @ default
      { 2.16.840.1.101.3.4.2.2, SHA-384, SHA2-384, SHA384 } @ default
      { 2.16.840.1.101.3.4.2.3, SHA-512, SHA2-512, SHA512 } @ default
      { 2.16.840.1.101.3.4.2.5, SHA-512/224, SHA2-512/224, SHA512-224 } @ default
      { 2.16.840.1.101.3.4.2.12, SHAKE-256, SHAKE256 } @ default
      { 2.16.840.1.101.3.4.2.1, SHA-256, SHA2-256, SHA256 } @ default
      { 1.3.14.3.2.26, SHA-1, SHA1, SSL3-SHA1 } @ default
      { 2.16.840.1.101.3.4.2.9, SHA3-384 } @ default
      { 2.16.840.1.101.3.4.2.11, SHAKE-128, SHAKE128 } @ default
      MD5-SHA1 @ default
      { 1.3.36.3.2.1, RIPEMD, RIPEMD-160, RIPEMD160, RMD160 } @ default
      { 1.2.840.113549.2.5, MD5, SSL3-MD5 } @ default
      { 2.16.840.1.101.3.4.2.4, SHA-224, SHA2-224, SHA224 } @ default
      { 1.3.6.1.4.1.1722.12.2.1.16, BLAKE2B-512, BLAKE2b512 } @ default
      { 2.16.840.1.101.3.4.2.6, SHA-512/256, SHA2-512/256, SHA512-256 } @ default
      { KECCAK-KMAC-128, KECCAK-KMAC128 } @ default
      { KECCAK-KMAC-256, KECCAK-KMAC256 } @ default
      NULL @ default
    $
    ```
    
    Fix #48483
    dd12bf32
    Use `SHA256` digest instead of `MD4` that is legacy in OpenSSL 3
    Yasuo Honda authored
    This commit updates the MD4 digest used in `MessageEncryptorsTest`
    because OpenSSL 3 moves `MD4` digests as legacy provider.
    
    https://www.openssl.org/news/openssl-3.0-notes.html
    Major changes between OpenSSL 3.0.0 and OpenSSL 3.0.1 [14 Dec 2021]
    > Moved the EVP digests MD2, MD4, MDC2, WHIRLPOOL and RIPEMD-160 to the legacy provider.
    
    Since Rails CI migrates from Debian 11 "bullseye" based Ruby 3.1 and 3.2 images
    to Debian 12 "bookworm" based ones, that supports OpenSSL 3,
    `MessageEncryptorsTest` raises `EVP_DigestSignInit: unsupported (OpenSSL::HMACError)`
    and `Digest initialization failed: initialization error (OpenSSL::Digest::DigestError)`
    
    https://packages.debian.org/bookworm/openssl
    > Package: openssl (3.0.9-1)
    
    `SHA256` is listed as `Provided:` via `openssl list -digest-algorithms` output,
    so it is safe to use `SHA256` digest in the `MessageEncryptorsTest`.
    
    ```
      { 2.16.840.1.101.3.4.2.1, SHA-256, SHA2-256, SHA256 } @ default
    ```
    
    ```
    $ openssl version
    OpenSSL 3.0.8 7 Feb 2023 (Library: OpenSSL 3.0.8 7 Feb 2023)
    $ openssl list -digest-algorithms
    Legacy:
      RSA-MD4 => MD4
      RSA-MD5 => MD5
      RSA-RIPEMD160 => RIPEMD160
      RSA-SHA1 => SHA1
      RSA-SHA1-2 => RSA-SHA1
      RSA-SHA224 => SHA224
      RSA-SHA256 => SHA256
      RSA-SHA3-224 => SHA3-224
      RSA-SHA3-256 => SHA3-256
      RSA-SHA3-384 => SHA3-384
      RSA-SHA3-512 => SHA3-512
      RSA-SHA384 => SHA384
      RSA-SHA512 => SHA512
      RSA-SHA512/224 => SHA512-224
      RSA-SHA512/256 => SHA512-256
      RSA-SM3 => SM3
      BLAKE2b512
      BLAKE2s256
      id-rsassa-pkcs1-v1_5-with-sha3-224 => SHA3-224
      id-rsassa-pkcs1-v1_5-with-sha3-256 => SHA3-256
      id-rsassa-pkcs1-v1_5-with-sha3-384 => SHA3-384
      id-rsassa-pkcs1-v1_5-with-sha3-512 => SHA3-512
      MD4
      md4WithRSAEncryption => MD4
      MD5
      MD5-SHA1
      md5WithRSAEncryption => MD5
      ripemd => RIPEMD160
      RIPEMD160
      ripemd160WithRSA => RIPEMD160
      rmd160 => RIPEMD160
      SHA1
      sha1WithRSAEncryption => SHA1
      SHA224
      sha224WithRSAEncryption => SHA224
      SHA256
      sha256WithRSAEncryption => SHA256
      SHA3-224
      SHA3-256
      SHA3-384
      SHA3-512
      SHA384
      sha384WithRSAEncryption => SHA384
      SHA512
      SHA512-224
      sha512-224WithRSAEncryption => SHA512-224
      SHA512-256
      sha512-256WithRSAEncryption => SHA512-256
      sha512WithRSAEncryption => SHA512
      SHAKE128
      SHAKE256
      SM3
      sm3WithRSAEncryption => SM3
      ssl3-md5 => MD5
      ssl3-sha1 => SHA1
      whirlpool
    Provided:
      { 2.16.840.1.101.3.4.2.10, SHA3-512 } @ default
      { 1.3.6.1.4.1.1722.12.2.2.8, BLAKE2S-256, BLAKE2s256 } @ default
      { 1.2.156.10197.1.401, SM3 } @ default
      { 2.16.840.1.101.3.4.2.8, SHA3-256 } @ default
      { 2.16.840.1.101.3.4.2.7, SHA3-224 } @ default
      { 2.16.840.1.101.3.4.2.2, SHA-384, SHA2-384, SHA384 } @ default
      { 2.16.840.1.101.3.4.2.3, SHA-512, SHA2-512, SHA512 } @ default
      { 2.16.840.1.101.3.4.2.5, SHA-512/224, SHA2-512/224, SHA512-224 } @ default
      { 2.16.840.1.101.3.4.2.12, SHAKE-256, SHAKE256 } @ default
      { 2.16.840.1.101.3.4.2.1, SHA-256, SHA2-256, SHA256 } @ default
      { 1.3.14.3.2.26, SHA-1, SHA1, SSL3-SHA1 } @ default
      { 2.16.840.1.101.3.4.2.9, SHA3-384 } @ default
      { 2.16.840.1.101.3.4.2.11, SHAKE-128, SHAKE128 } @ default
      MD5-SHA1 @ default
      { 1.3.36.3.2.1, RIPEMD, RIPEMD-160, RIPEMD160, RMD160 } @ default
      { 1.2.840.113549.2.5, MD5, SSL3-MD5 } @ default
      { 2.16.840.1.101.3.4.2.4, SHA-224, SHA2-224, SHA224 } @ default
      { 1.3.6.1.4.1.1722.12.2.1.16, BLAKE2B-512, BLAKE2b512 } @ default
      { 2.16.840.1.101.3.4.2.6, SHA-512/256, SHA2-512/256, SHA512-256 } @ default
      { KECCAK-KMAC-128, KECCAK-KMAC128 } @ default
      { KECCAK-KMAC-256, KECCAK-KMAC256 } @ default
      NULL @ default
    $
    ```
    
    Fix #48483
Loading