9:47 a.m.
https://bugzilla.redhat.com/show_bug.cgi?id=1038683
Bug ID: 1038683
Summary: golang appears to contain an ECC implementation
Product: Fedora
Version: 20
Component: golang
Assignee: adam(a)spicenitz.org
Reporter: notting(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: adam(a)spicenitz.org, admiller(a)redhat.com,
golang(a)lists.fedoraproject.org, lemenkov(a)gmail.com,
lsm5(a)redhat.com, renich(a)woralelandia.com,
skottler(a)redhat.com, vbatts(a)redhat.com
Blocks: 182235 (FE-Legal), 1019390 (ecc)
Description of problem:
At least, I would assume that's what is in go/src/pkg/crypto/elliptic/.
In Fedora, we only ship certain reviewed curves.
Version-Release number of selected component (if applicable):
1.2-1
How reproducible:
100%
Steps to Reproduce:
1. look at golang's crypto code
Actual results:
Hey, that looks like ECC, and it appears to have been always included.
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=182235
[Bug 182235] Fedora Legal Tracker
https://bugzilla.redhat.com/show_bug.cgi?id=1019390
[Bug 1019390] [tracking bug] re-enable ECC/ECDHE/EC/ECDSA/elliptic curves
in Fedora
--
You are receiving this mail because:
You are on the CC list for the bug.
10:04 a.m.
New subject: [Bug 1038683] golang appears to contain an ECC implementation
https://bugzilla.redhat.com/show_bug.cgi?id=1038683
Vincent Batts <vbatts(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Assignee|adam(a)spicenitz.org |vbatts(a)redhat.com
--
You are receiving this mail because:
You are on the CC list for the bug.
10:09 a.m.
New subject: [Bug 1038683] golang appears to contain an ECC implementation
https://bugzilla.redhat.com/show_bug.cgi?id=1038683
--- Comment #1 from Vincent Batts <vbatts(a)redhat.com> ---
This will take a bit of work/consideration on which curves are not allowed.
From just stdlib alone, the following libraries import from
crypto/elliptic:
* crypto/ecdsa
* crypto/x509
- also imports from crypto/ecdsa
* crypto/tls
- also imports from crypto/ecdsa
- also imports from crypto/x509
--
You are receiving this mail because:
You are on the CC list for the bug.
10:13 a.m.
New subject: [Bug 1038683] golang appears to contain an ECC implementation
https://bugzilla.redhat.com/show_bug.cgi?id=1038683
--- Comment #2 from Vincent Batts <vbatts(a)redhat.com> ---
per http://golang.org/src/pkg/crypto/ecdsa/ecdsa.go, the ecdsa implementation
is to spec of the Suite B guide for FIPS 186-3
--
You are receiving this mail because:
You are on the CC list for the bug.
10:15 a.m.
New subject: [Bug 1038683] golang appears to contain an ECC implementation
https://bugzilla.redhat.com/show_bug.cgi?id=1038683
Vincent Batts <vbatts(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |ASSIGNED
--
You are receiving this mail because:
You are on the CC list for the bug.
11:54 a.m.
New subject: [Bug 1038683] golang appears to contain an ECC implementation
https://bugzilla.redhat.com/show_bug.cgi?id=1038683
--- Comment #9 from Vincent Batts <vbatts(a)redhat.com> ---
I've pushed a patched build to rawhide, to bake for a bit.
http://koji.fedoraproject.org/koji/buildinfo?buildID=485741
--
You are receiving this mail because:
You are on the CC list for the bug.
8:18 p.m.
New subject: [Bug 1038683] golang appears to contain an ECC implementation
https://bugzilla.redhat.com/show_bug.cgi?id=1038683
Fedora Update System <updates(a)fedoraproject.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|ASSIGNED |MODIFIED
--
You are receiving this mail because:
You are on the CC list for the bug.
8:18 p.m.
New subject: [Bug 1038683] golang appears to contain an ECC implementation
https://bugzilla.redhat.com/show_bug.cgi?id=1038683
--- Comment #10 from Fedora Update System <updates(a)fedoraproject.org> ---
golang-1.2-3.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/golang-1.2-3.fc19
--
You are receiving this mail because:
You are on the CC list for the bug.
8:19 p.m.
New subject: [Bug 1038683] golang appears to contain an ECC implementation
https://bugzilla.redhat.com/show_bug.cgi?id=1038683
--- Comment #11 from Fedora Update System <updates(a)fedoraproject.org> ---
golang-1.2-3.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/golang-1.2-3.fc20
--
You are receiving this mail because:
You are on the CC list for the bug.
8:21 p.m.
New subject: [Bug 1038683] golang appears to contain an ECC implementation
https://bugzilla.redhat.com/show_bug.cgi?id=1038683
--- Comment #12 from Fedora Update System <updates(a)fedoraproject.org> ---
golang-1.2-3.el6 has been submitted as an update for Fedora EPEL 6.
https://admin.fedoraproject.org/updates/golang-1.2-3.el6
--
You are receiving this mail because:
You are on the CC list for the bug.
11:21 p.m.
New subject: [Bug 1038683] golang appears to contain an ECC implementation
https://bugzilla.redhat.com/show_bug.cgi?id=1038683
Fedora Update System <updates(a)fedoraproject.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|MODIFIED |ON_QA
--- Comment #13 from Fedora Update System <updates(a)fedoraproject.org> ---
Package golang-1.2-3.el6:
* should fix your issue,
* was pushed to the Fedora EPEL 6 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=epel-testing golang-1.2-3.el6'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-0257/golang-1.2-...
then log in and leave karma (feedback).
--
You are receiving this mail because:
You are on the CC list for the bug.
9:02 p.m.
New subject: [Bug 1038683] golang appears to contain an ECC implementation
https://bugzilla.redhat.com/show_bug.cgi?id=1038683
Fedora Update System <updates(a)fedoraproject.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|ON_QA |CLOSED
Fixed In Version| |golang-1.2-3.fc20
Resolution|--- |ERRATA
Last Closed| |2014-01-28 22:02:44
--- Comment #14 from Fedora Update System <updates(a)fedoraproject.org> ---
golang-1.2-3.fc20 has been pushed to the Fedora 20 stable repository. If
problems still persist, please make note of it in this bug report.
--
You are receiving this mail because:
You are on the CC list for the bug.
9:36 p.m.
New subject: [Bug 1038683] golang appears to contain an ECC implementation
https://bugzilla.redhat.com/show_bug.cgi?id=1038683
Fedora Update System <updates(a)fedoraproject.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Fixed In Version|golang-1.2-3.fc20 |golang-1.2-3.fc19
--- Comment #15 from Fedora Update System <updates(a)fedoraproject.org> ---
golang-1.2-3.fc19 has been pushed to the Fedora 19 stable repository. If
problems still persist, please make note of it in this bug report.
--
You are receiving this mail because:
You are on the CC list for the bug.
1:25 p.m.
New subject: [Bug 1038683] golang appears to contain an ECC implementation
https://bugzilla.redhat.com/show_bug.cgi?id=1038683
Fedora Update System <updates(a)fedoraproject.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Fixed In Version|golang-1.2-3.fc19 |golang-1.2-3.el6
--- Comment #16 from Fedora Update System <updates(a)fedoraproject.org> ---
golang-1.2-3.el6 has been pushed to the Fedora EPEL 6 stable repository. If
problems still persist, please make note of it in this bug report.
--
You are receiving this mail because:
You are on the CC list for the bug.
3:13 p.m.
New subject: [Bug 1038683] golang appears to contain an ECC implementation
https://bugzilla.redhat.com/show_bug.cgi?id=1038683
Daniel Walsh <dwalsh(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|CLOSED |ASSIGNED
CC| |dwalsh(a)redhat.com
Version|20 |24
Resolution|ERRATA |---
Keywords| |Reopened
--- Comment #17 from Daniel Walsh <dwalsh(a)redhat.com> ---
Reopening this bug as this patch is now causing docker builds to fail.
--
You are receiving this mail because:
You are on the CC list for the bug.
3:16 p.m.
New subject: [Bug 1038683] golang appears to contain an ECC implementation
https://bugzilla.redhat.com/show_bug.cgi?id=1038683
--- Comment #18 from Daniel Walsh <dwalsh(a)redhat.com> ---
Can we revisit this decision, has anything changed in the last few years. Can
we implement just the elyptical curves that the NSA has licenses for?
--
You are receiving this mail because:
You are on the CC list for the bug.
3:17 p.m.
New subject: [Bug 1038683] golang appears to contain an ECC implementation
https://bugzilla.redhat.com/show_bug.cgi?id=1038683
Lokesh Mandvekar <lsm5(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Assignee|vbatts(a)redhat.com |jcajka(a)redhat.com
--
You are receiving this mail because:
You are on the CC list for the bug.
3:18 p.m.
New subject: [Bug 1038683] golang appears to contain an ECC implementation
https://bugzilla.redhat.com/show_bug.cgi?id=1038683
--- Comment #19 from Daniel Walsh <dwalsh(a)redhat.com> ---
hack/make.sh dynbinary
# WARNING! I don't seem to be running in a Docker container.
# The result of this command might be an incorrect build, and will not be
# officially supported.
#
# Try this instead: make all
#
bundles/1.12.0-dev already exists. Removing.
---> Making bundle: dynbinary (in bundles/1.12.0-dev/dynbinary)
Building: bundles/1.12.0-dev/dynbinary-client/docker-1.12.0-dev
Created binary: bundles/1.12.0-dev/dynbinary-client/docker-1.12.0-dev
Building: bundles/1.12.0-dev/dynbinary-daemon/dockerd-1.12.0-dev
# github.com/google/certificate-transparency/go/x509
vendor/src/github.com/google/certificate-transparency/go/x509/x509.go:342:
undefined: elliptic.P224
vendor/src/github.com/google/certificate-transparency/go/x509/x509.go:355:
undefined: elliptic.P224
vendor/src/github.com/google/certificate-transparency/go/x509/x509.go:1461:
undefined: elliptic.P224
[Exit 1]
--
You are receiving this mail because:
You are on the CC list for the bug.
4:33 p.m.
New subject: [Bug 1038683] golang appears to contain an ECC implementation
https://bugzilla.redhat.com/show_bug.cgi?id=1038683
Tom "spot" Callaway <tcallawa(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |tcallawa(a)redhat.com
--- Comment #20 from Tom "spot" Callaway <tcallawa(a)redhat.com> ---
I'm checking into this.
--
You are receiving this mail because:
You are on the CC list for the bug.
3:33 a.m.
New subject: [Bug 1038683] golang appears to contain an ECC implementation
https://bugzilla.redhat.com/show_bug.cgi?id=1038683
Antonio Murdaca <amurdaca(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |amurdaca(a)redhat.com
--- Comment #21 from Antonio Murdaca <amurdaca(a)redhat.com> ---
if this isn't doable, however we can use this patch:
diff --git
a/vendor/src/github.com/google/certificate-transparency/go/x509/x509.go
b/vendor/src/github.com/google/certificate-transparency/go/x509/x509.go
old mode 100755
new mode 100644
index cda7220..d879b91
--- a/vendor/src/github.com/google/certificate-transparency/go/x509/x509.go
+++ b/vendor/src/github.com/google/certificate-transparency/go/x509/x509.go
@@ -330,7 +330,6 @@ func getPublicKeyAlgorithmFromOID(oid
asn1.ObjectIdentifier) PublicKeyAlgorithm
//
// NB: secp256r1 is equivalent to prime256v1
var (
- oidNamedCurveP224 = asn1.ObjectIdentifier{1, 3, 132, 0, 33}
oidNamedCurveP256 = asn1.ObjectIdentifier{1, 2, 840, 10045, 3, 1, 7}
oidNamedCurveP384 = asn1.ObjectIdentifier{1, 3, 132, 0, 34}
oidNamedCurveP521 = asn1.ObjectIdentifier{1, 3, 132, 0, 35}
@@ -338,8 +337,6 @@ var (
func namedCurveFromOID(oid asn1.ObjectIdentifier) elliptic.Curve {
switch {
- case oid.Equal(oidNamedCurveP224):
- return elliptic.P224()
case oid.Equal(oidNamedCurveP256):
return elliptic.P256()
case oid.Equal(oidNamedCurveP384):
@@ -352,8 +349,6 @@ func namedCurveFromOID(oid asn1.ObjectIdentifier)
elliptic.Curve {
func oidFromNamedCurve(curve elliptic.Curve) (asn1.ObjectIdentifier, bool) {
switch curve {
- case elliptic.P224():
- return oidNamedCurveP224, true
case elliptic.P256():
return oidNamedCurveP256, true
case elliptic.P384():
@@ -1458,7 +1453,7 @@ func CreateCertificate(rand io.Reader, template, parent
*Certificate, pub interf
hashFunc = crypto.SHA1
case *ecdsa.PrivateKey:
switch priv.Curve {
- case elliptic.P224(), elliptic.P256():
+ case elliptic.P256():
hashFunc = crypto.SHA256
signatureAlgorithm.Algorithm = oidSignatureECDSAWithSHA256
case elliptic.P384():
--
You are receiving this mail because:
You are on the CC list for the bug.
2864
days inactive
3789
days old
golang@lists.fedoraproject.org
19 comments
1 participants
participants (1)
-
Red Hat Bugzilla