[Bug 1822984] Re: revert tls security level back to 1

[Dimitri John Ledkov]

But equally, I would not want to keep cosmic more insecure than what
bionic and disco will be. And currently, cosmic is a release regression
w.r.t. bionic GA. Upgrading to newer releases, should not result in
looser acceptance of insecure protocols.

** Description changed:

  [Impact]
  * increase minimum default tls security level from 0 to 1, as is the default upstream
  
  [Test Case]
  
  * generate 80bits TLS certificate and attempt to use it
  
  * with prior openssl it should work, but with this update it should fail
  
  [Regression Potential]
  
  * This increases the minimum required certificate/keys sizes and
  algorithms, back to what Bionic GA openssl 1.1.0 shipped as. It also now
  will match upstream default. It is still lower than Debian's default
  that raises it to 2 by default.
+ 
+ * Cosmic GA shipped with TLS_SECURITY_LEVEL 0, meaning pretty much any
+ weak keys were accepted. With this change keys lower than 112 will be
+ rejected, which are considered to be too weak to be useful by most CAs
+ out there.

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to openssl in Ubuntu.
https://bugs.launchpad.net/bugs/1822984

Title:
  revert tls security level back to 1

Status in openssl package in Ubuntu:
  Fix Committed
Status in openssl source package in Cosmic:
  New
Status in openssl source package in Disco:
  Fix Committed

Bug description:
  [Impact]
  * increase minimum default tls security level from 0 to 1, as is the default upstream

  [Test Case]

  * generate 80bits TLS certificate and attempt to use it

  * with prior openssl it should work, but with this update it should
  fail

  [Regression Potential]

  * This increases the minimum required certificate/keys sizes and
  algorithms, back to what Bionic GA openssl 1.1.0 shipped as. It also
  now will match upstream default. It is still lower than Debian's
  default that raises it to 2 by default.

  * Cosmic GA shipped with TLS_SECURITY_LEVEL 0, meaning pretty much any
  weak keys were accepted. With this change keys lower than 112 will be
  rejected, which are considered to be too weak to be useful by most CAs
  out there.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1822984/+subscriptions