[Openstack-security] [openstack/keystone] SecurityImpact review request change Iafe3c975d59818c8f362647f7ea5149a03deee47
gerrit2 at review.openstack.org
gerrit2 at review.openstack.org
Thu Apr 3 22:28:27 UTC 2014
Hi, I'd like you to take a look at this patch for potential
SecurityImpact.
https://review.openstack.org/80401
Log:
commit 41a448f8b2ca0052b528186253310d5cefb2c7f7
Author: Brant Knudson <bknudson at us.ibm.com>
Date: Thu Mar 27 19:10:10 2014 -0500
Configurable token hash algorithm
Tokens were always hashed with MD5. This change allows tokens to
be hashed with SHA256 (or any other algorithm supported by the
keystoneclient token hash function). This is for security
hardening.
There's a new configuration option 'hash_algorithm' in the [token]
section. This is the algorithm to use for hashing tokens for the
revocation list. If this is not set then MD5 is used. If it's set to
a hash algorithm (such as 'sha256'), then PKI tokens will be hashed
using that algorithm. Also, the configured hash algorithm is now
set on the revocation list object for use by the auth_token
middleware.
SecurityImpact
DocImpact
Closes-Bug: #1174499
Change-Id: Iafe3c975d59818c8f362647f7ea5149a03deee47
More information about the Openstack-security
mailing list