Function: nsm-protocol-check--md5-sig

nsm-protocol-check--md5-sig is a byte-compiled function defined in nsm.el.gz.

Signature

(nsm-protocol-check--md5-sig HOST PORT STATUS &optional SETTINGS)

Documentation

Check for MD5 signatures on certificates.

In 2008, a group of researchers were able to forge an intermediate CA certificate that appeared to be legitimate when checked by MD5[1]. RFC 6151[2] has recommended against the usage of MD5 for digital signatures, which includes TLS certificate signatures.

Since GnuTLS 3.3.0, MD5 has been disabled by default, but can be enabled if requested.

References:

[1]: Sotirov A, Stevens M et al (2008). "MD5 considered harmful today
- Creating a rogue CA certificate",
https://www.win.tue.nl/hashclash/rogue-ca/
[2]: Turner S, Chen L (2011). "Updated Security Considerations for
the MD5 Message-Digest and the HMAC-MD5 Algorithms", https://tools.ietf.org/html/rfc6151

Source Code

;; Defined in /usr/src/emacs/lisp/net/nsm.el.gz
(defun nsm-protocol-check--md5-sig (_host _port status &optional _settings)
  "Check for MD5 signatures on certificates.

In 2008, a group of researchers were able to forge an
intermediate CA certificate that appeared to be legitimate when
checked by MD5[1].  RFC 6151[2] has recommended against the usage
of MD5 for digital signatures, which includes TLS certificate
signatures.

Since GnuTLS 3.3.0, MD5 has been disabled by default, but can be
enabled if requested.

References:

[1]: Sotirov A, Stevens M et al (2008).  \"MD5 considered harmful today
- Creating a rogue CA certificate\",
`https://www.win.tue.nl/hashclash/rogue-ca/'
[2]: Turner S, Chen L (2011).  \"Updated Security Considerations for
the MD5 Message-Digest and the HMAC-MD5 Algorithms\",
`https://tools.ietf.org/html/rfc6151'"
  (cl-loop for certificate in (plist-get status :certificates)
           for algo = (plist-get certificate :signature-algorithm)
           ;; Don't check root certificates -- root is always trusted.
           if (and (not (equal (plist-get certificate :issuer)
                               (plist-get certificate :subject)))
                   (string-match "\\bMD5\\b" algo))
           return (format-message
                   "MD5 signature (%s) is very prone to collisions"
                   algo)
           end))