Re: [PATCH] Implement https public key pinning

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Daniel Stenberg <daniel@xxxxxxx> writes:
> On Thu, 11 Feb 2016, Christoph Egger wrote:
>> +#if LIBCURL_VERSION_NUM >= 0x074400
>
> That should probably be 0x072c00 ...

This is, of course, right.

I used 7.44 / 0x072c00 as base because it has robust support for this
feature (including the sha256// variant). One could lower that depending
on the compromises one is willing to take FWIW

  Added in 7.39.0 for OpenSSL, GnuTLS and GSKit. Added in 7.43.0 for NSS
  and wolfSSL/CyaSSL. Added for mbedtls in 7.47.0, sha256 support added
  in 7.44.0 for OpenSSL, GnuTLS, NSS and wolfSSL/CyaSSL. Other SSL
  backends not supported.

Also some people suggested that git should fail if this option is
requested in the config but not supported by the libcurl version instead
of falling back to just not pin the key. I'm undecided about that.

  Christoph

Attachment: signature.asc
Description: PGP signature


[Index of Archives]     [Linux Kernel Development]     [Gcc Help]     [IETF Annouce]     [DCCP]     [Netdev]     [Networking]     [Security]     [V4L]     [Bugtraq]     [Yosemite]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux SCSI]     [Fedora Users]