Skip to content

context: consider deprecating support for legacy PEM encryption as specified in RFC 1423 #3212

@thaJeztah

Description

@thaJeztah

PR's #1501 / #1500 added support for TLS config using encryption as specified in RFC 1423, however, that functionality has been deprecated in Go, and causes linting to fail on Go 1.16;

cli/context/docker/load.go:69:6: SA1019: x509.IsEncryptedPEMBlock is deprecated: Legacy PEM encryption as specified in RFC 1423 is insecure by design. Since it does not authenticate the ciphertext, it is vulnerable to padding oracle attacks that can let an attacker recover the plaintext.  (staticcheck)
        if x509.IsEncryptedPEMBlock(pemBlock) {
           ^
cli/context/docker/load.go:70:20: SA1019: x509.DecryptPEMBlock is deprecated: Legacy PEM encryption as specified in RFC 1423 is insecure by design. Since it does not authenticate the ciphertext, it is vulnerable to padding oracle attacks that can let an attacker recover the plaintext.  (staticcheck)
            keyBytes, err = x509.DecryptPEMBlock(pemBlock, []byte(c.TLSPassword))
                            ^

From https://go-review.googlesource.com/c/go/+/264159

It's unfortunate that we don't implement PKCS#8 encryption so we can't
recommend an alternative but PEM encryption is so broken that it's worth
deprecating outright.

We should consider deprecating this functionality (log a warning and/or produce an error)

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions