Commit f8dd55bb authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

For more than 160 bits of security disable SHA1 HMAC

parent b7e46a9b

ssl/ssl_cert.c

+3 −0
Original line number Diff line number Diff line
@@ -1411,6 +1411,9 @@ static int ssl_security_default_callback(SSL *s, SSL_CTX *ctx, int op, int bits, 
		/* No MD5 mac ciphersuites */

		if (c->algorithm_mac & SSL_MD5)

			return 0;

		/* SHA1 HMAC is 160 bits of security */

		if (minbits > 160 && c->algorithm_mac & SSL_SHA1)

			return 0;

		/* Level 2: no RC4 */

		if (level >= 2 && c->algorithm_enc == SSL_RC4)

			return 0;