diff options
| author | lloyd <[email protected]> | 2010-08-13 14:56:54 +0000 |
|---|---|---|
| committer | lloyd <[email protected]> | 2010-08-13 14:56:54 +0000 |
| commit | 71b0809de2d7c5aa79675283c79e24a5424c741f (patch) | |
| tree | f9666816301fda78fde8929e08e42ee92890cbd3 | |
| parent | 2c4c5b376130b55e092b2aa0ba47b97bfc31962c (diff) | |
The changelog for 1.9.4 claimed that the default PKCS #8 encryption
algorithm had changed to AES-256. This was wrong, it actually changed
to AES-128. However in retrospect AES-256 is probably a reasonable
move (in particular for the 4 extra rounds; the related key attacks
possible against AES-256 are probably not viable since we generate the
key using PBKDF2), so update the 1.9.4 changelog to correctly indicate
the change made in that release, and also modify PKCS #8 to actually
use AES-256.
| -rw-r--r-- | doc/log.txt | 5 | ||||
| -rw-r--r-- | src/pubkey/pkcs8.cpp | 2 |
2 files changed, 5 insertions, 2 deletions
diff --git a/doc/log.txt b/doc/log.txt index fd5b28645..f9092da21 100644 --- a/doc/log.txt +++ b/doc/log.txt @@ -1,4 +1,7 @@ +* 1.9.11-dev, ????-??-?? + - Switch default PKCS #8 encryption algorithm from AES-128 to AES-256 + * 1.9.10, 2010-08-12 - Add a constant time AES implementation using SSSE3 - Add support for loading new Engines at runtime @@ -87,7 +90,7 @@ - Fix an invalid memory read in MD4 - Fix Visual C++ static builds - Remove Timer class entirely - - Switch default PKCS #8 encryption algorithm from 3DES to AES-256 + - Switch default PKCS #8 encryption algorithm from 3DES to AES-128 - New option --gen-amalgamation for creating a SQLite-style amalgamation - Many headers are now explicitly internal-use-only and are not installed - Greatly improve the Win32 installer diff --git a/src/pubkey/pkcs8.cpp b/src/pubkey/pkcs8.cpp index 3c767959f..5eed776be 100644 --- a/src/pubkey/pkcs8.cpp +++ b/src/pubkey/pkcs8.cpp @@ -160,7 +160,7 @@ SecureVector<byte> BER_encode(const Private_Key& key, const std::string& pass, const std::string& pbe_algo) { - const std::string DEFAULT_PBE = "PBE-PKCS5v20(SHA-1,AES-128/CBC)"; + const std::string DEFAULT_PBE = "PBE-PKCS5v20(SHA-1,AES-256/CBC)"; std::auto_ptr<PBE> pbe(get_pbe(((pbe_algo != "") ? pbe_algo : DEFAULT_PBE))); |