pki: Use SHA-256 as default for signatures

Since the BLISS private key supports this we don't do any special
handling anymore (if the user choses a digest that is not supported,
signing will simply fail later because no signature scheme will be found).

diff --git a/src/pki/commands/acert.c b/src/pki/commands/acert.c
index e571318..3a35b06 100644 (file)
--- a/src/pki/commands/acert.c
+++ b/src/pki/commands/acert.c
@@ -32,7 +32,7 @@
 static int acert()
 {
        cred_encoding_type_t form = CERT_ASN1_DER;
-       hash_algorithm_t digest = HASH_SHA1;
+       hash_algorithm_t digest = HASH_SHA256;
        certificate_t *ac = NULL, *cert = NULL, *issuer =NULL;
        private_key_t *private = NULL;
        public_key_t *public = NULL;
@@ -167,14 +167,6 @@ static int acert()
                error = "issuer private key does not match issuer certificate";
                goto end;
        }
-       if (private->get_type(private) == KEY_BLISS)
-       {
-               /* the default hash function is SHA512. SHA1 is not supported */
-               if (digest == HASH_SHA1)
-               {
-                       digest = HASH_SHA512;
-               }
-       }
 
        if (hex)
        {
@@ -295,7 +287,7 @@ static void __attribute__ ((constructor))reg()
                        {"not-before",          'F', 1, "date/time the validity of the AC starts"},
                        {"not-after",           'T', 1, "date/time the validity of the AC ends"},
                        {"dateform",            'D', 1, "strptime(3) input format, default: %d.%m.%y %T"},
-                       {"digest",                      'g', 1, "digest for signature creation, default: sha1"},
+                       {"digest",                      'g', 1, "digest for signature creation, default: sha256"},
                        {"outform",                     'f', 1, "encoding of generated cert, default: der"},
                }
        });

diff --git a/src/pki/commands/issue.c b/src/pki/commands/issue.c
index fba0238..050ead7 100644 (file)
--- a/src/pki/commands/issue.c
+++ b/src/pki/commands/issue.c
@@ -60,7 +60,7 @@ static void destroy_cdp(x509_cdp_t *this)
 static int issue()
 {
        cred_encoding_type_t form = CERT_ASN1_DER;
-       hash_algorithm_t digest = HASH_SHA1;
+       hash_algorithm_t digest = HASH_SHA256;
        certificate_t *cert_req = NULL, *cert = NULL, *ca =NULL;
        private_key_t *private = NULL;
        public_key_t *public = NULL;
@@ -364,14 +364,6 @@ static int issue()
        }
        public->destroy(public);
 
-       if (private->get_type(private) == KEY_BLISS)
-       {
-               /* the default hash function is SHA512. SHA1 is not supported */
-               if (digest == HASH_SHA1)
-               {
-                       digest = HASH_SHA512;
-               }
-       }
        if (hex)
        {
                serial = chunk_from_hex(chunk_create(hex, strlen(hex)), NULL);
@@ -599,7 +591,7 @@ static void __attribute__ ((constructor))reg()
                        {"crl",                         'u', 1, "CRL distribution point URI to include"},
                        {"crlissuer",           'I', 1, "CRL Issuer for CRL at distribution point"},
                        {"ocsp",                        'o', 1, "OCSP AuthorityInfoAccess URI to include"},
-                       {"digest",                      'g', 1, "digest for signature creation, default: sha1"},
+                       {"digest",                      'g', 1, "digest for signature creation, default: sha256"},
                        {"outform",                     'f', 1, "encoding of generated cert, default: der"},
                }
        });

diff --git a/src/pki/commands/req.c b/src/pki/commands/req.c
index 39d7162..13ef1c9 100644 (file)
--- a/src/pki/commands/req.c
+++ b/src/pki/commands/req.c
@@ -31,7 +31,7 @@ static int req()
 {
        cred_encoding_type_t form = CERT_ASN1_DER;
        key_type_t type = KEY_RSA;
-       hash_algorithm_t digest = HASH_SHA1;
+       hash_algorithm_t digest = HASH_SHA256;
        certificate_t *cert = NULL;
        private_key_t *private = NULL;
        char *file = NULL, *dn = NULL, *error = NULL;
@@ -103,14 +103,6 @@ static int req()
                break;
        }
 
-       if (type == KEY_BLISS)
-       {
-               /* the default hash function is SHA512. SHA1 is not supported */
-               if (digest == HASH_SHA1)
-               {
-                       digest = HASH_SHA512;
-               }
-       }
        if (!dn)
        {
                error = "--dn is required";
@@ -208,7 +200,7 @@ static void __attribute__ ((constructor))reg()
                        {"dn",          'd', 1, "subject distinguished name"},
                        {"san",         'a', 1, "subjectAltName to include in cert request"},
                        {"password",'p', 1, "challengePassword to include in cert request"},
-                       {"digest",      'g', 1, "digest for signature creation, default: sha1"},
+                       {"digest",      'g', 1, "digest for signature creation, default: sha256"},
                        {"outform",     'f', 1, "encoding of generated request, default: der"},
                }
        });

diff --git a/src/pki/commands/self.c b/src/pki/commands/self.c
index 8dcb046..13374e2 100644 (file)
--- a/src/pki/commands/self.c
+++ b/src/pki/commands/self.c
@@ -50,7 +50,7 @@ static int self()
 {
        cred_encoding_type_t form = CERT_ASN1_DER;
        key_type_t type = KEY_RSA;
-       hash_algorithm_t digest = HASH_SHA1;
+       hash_algorithm_t digest = HASH_SHA256;
        certificate_t *cert = NULL;
        private_key_t *private = NULL;
        public_key_t *public = NULL;
@@ -263,14 +263,6 @@ static int self()
                break;
        }
 
-       if (type == KEY_BLISS)
-       {
-               /* the default hash function is SHA512. SHA1 is not supported */
-               if (digest == HASH_SHA1)
-               {
-                       digest = HASH_SHA512;
-               }
-       }
        if (!dn)
        {
                error = "--dn is required";
@@ -455,7 +447,7 @@ static void __attribute__ ((constructor))reg()
                        {"policy-any",          'A', 1, "inhibitAnyPolicy constraint"},
                        {"flag",                        'e', 1, "include extendedKeyUsage flag"},
                        {"ocsp",                        'o', 1, "OCSP AuthorityInfoAccess URI to include"},
-                       {"digest",                      'g', 1, "digest for signature creation, default: sha1"},
+                       {"digest",                      'g', 1, "digest for signature creation, default: sha256"},
                        {"outform",                     'f', 1, "encoding of generated cert, default: der"},
                }
        });

diff --git a/src/pki/commands/signcrl.c b/src/pki/commands/signcrl.c
index 4b81c77..aa40322 100644 (file)
--- a/src/pki/commands/signcrl.c
+++ b/src/pki/commands/signcrl.c
@@ -117,7 +117,7 @@ static int sign_crl()
        certificate_t *ca = NULL, *crl = NULL;
        crl_t *lastcrl = NULL;
        x509_t *x509;
-       hash_algorithm_t digest = HASH_SHA1;
+       hash_algorithm_t digest = HASH_SHA256;
        char *arg, *cacert = NULL, *cakey = NULL, *lastupdate = NULL, *error = NULL;
        char *basecrl = NULL;
        char serial[512], *keyid = NULL;
@@ -335,14 +335,6 @@ static int sign_crl()
                error = "CA private key does not match CA certificate";
                goto error;
        }
-       if (private->get_type(private) == KEY_BLISS)
-       {
-               /* the default hash function is SHA512. SHA1 is not supported */
-               if (digest == HASH_SHA1)
-               {
-                       digest = HASH_SHA512;
-               }
-       }
 
        if (basecrl)
        {
@@ -473,7 +465,7 @@ static void __attribute__ ((constructor))reg()
                        {"serial",              's', 1, "hex encoded certificate serial number to revoke"},
                        {"reason",              'r', 1, "reason for certificate revocation"},
                        {"date",                'd', 1, "revocation date as unix timestamp, default: now"},
-                       {"digest",              'g', 1, "digest for signature creation, default: sha1"},
+                       {"digest",              'g', 1, "digest for signature creation, default: sha256"},
                        {"outform",             'f', 1, "encoding of generated crl, default: der"},
                }
        });

diff --git a/src/pki/man/pki---acert.1.in b/src/pki/man/pki---acert.1.in
index ec1d8be..48a5203 100644 (file)
--- a/src/pki/man/pki---acert.1.in
+++ b/src/pki/man/pki---acert.1.in
@@ -100,7 +100,7 @@ Serial number in hex. It is randomly allocated by default.
 .BI "\-g, \-\-digest " digest
 Digest to use for signature creation. One of \fImd5\fR, \fIsha1\fR,
 \fIsha224\fR, \fIsha256\fR, \fIsha384\fR, or \fIsha512\fR. Defaults to
-\fIsha1\fR.
+\fIsha256\fR.
 .TP
 .BI "\-f, \-\-outform " encoding
 Encoding of the created certificate file. Either \fIder\fR (ASN.1 DER) or

diff --git a/src/pki/man/pki---issue.1.in b/src/pki/man/pki---issue.1.in
index d017bfe..d4e20fd 100644 (file)
--- a/src/pki/man/pki---issue.1.in
+++ b/src/pki/man/pki---issue.1.in
@@ -123,7 +123,7 @@ Add extendedKeyUsage flag. One of \fIserverAuth\fR, \fIclientAuth\fR,
 .BI "\-g, \-\-digest " digest
 Digest to use for signature creation. One of \fImd5\fR, \fIsha1\fR,
 \fIsha224\fR, \fIsha256\fR, \fIsha384\fR, or \fIsha512\fR. Defaults to
-\fIsha1\fR.
+\fIsha256\fR.
 .TP
 .BI "\-f, \-\-outform " encoding
 Encoding of the created certificate file. Either \fIder\fR (ASN.1 DER) or

diff --git a/src/pki/man/pki---req.1.in b/src/pki/man/pki---req.1.in
index ab144ce..397d2e2 100644 (file)
--- a/src/pki/man/pki---req.1.in
+++ b/src/pki/man/pki---req.1.in
@@ -63,7 +63,7 @@ The challengePassword to include in the certificate request.
 .BI "\-g, \-\-digest " digest
 Digest to use for signature creation. One of \fImd5\fR, \fIsha1\fR,
 \fIsha224\fR, \fIsha256\fR, \fIsha384\fR, or \fIsha512\fR. Defaults to
-\fIsha1\fR.
+\fIsha256\fR.
 .TP
 .BI "\-f, \-\-outform " encoding
 Encoding of the created certificate file. Either \fIder\fR (ASN.1 DER) or

diff --git a/src/pki/man/pki---self.1.in b/src/pki/man/pki---self.1.in
index 03ce039..da33632 100644 (file)
--- a/src/pki/man/pki---self.1.in
+++ b/src/pki/man/pki---self.1.in
@@ -110,7 +110,7 @@ Add extendedKeyUsage flag. One of \fIserverAuth\fR, \fIclientAuth\fR,
 .BI "\-g, \-\-digest " digest
 Digest to use for signature creation. One of \fImd5\fR, \fIsha1\fR,
 \fIsha224\fR, \fIsha256\fR, \fIsha384\fR, or \fIsha512\fR. Defaults to
-\fIsha1\fR.
+\fIsha256\fR.
 .TP
 .BI "\-f, \-\-outform " encoding
 Encoding of the created certificate file. Either \fIder\fR (ASN.1 DER) or

diff --git a/src/pki/man/pki---signcrl.1.in b/src/pki/man/pki---signcrl.1.in
index bd6cba5..eae3f81 100644 (file)
--- a/src/pki/man/pki---signcrl.1.in
+++ b/src/pki/man/pki---signcrl.1.in
@@ -99,7 +99,7 @@ Freshest delta CRL URI to include in CRL. Can be used multiple times.
 .BI "\-g, \-\-digest " digest
 Digest to use for signature creation. One of \fImd5\fR, \fIsha1\fR,
 \fIsha224\fR, \fIsha256\fR, \fIsha384\fR, or \fIsha512\fR. Defaults to
-\fIsha1\fR.
+\fIsha256\fR.
 .TP
 .BI "\-f, \-\-outform " encoding
 Encoding of the created certificate file. Either \fIder\fR (ASN.1 DER) or