Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added USE_MQTT_TLS_DROP_OLD_FINGERPRINT compile time option to drop old (less secure) TLS fingerprint #10584

Merged

Conversation

s-hadinger
Copy link
Collaborator

Description:

Add a compile time option to drop the old algorithm for TLS Fingerprint.

All fingerprints are automatically updated to the new algo at first connection, however if the check fails, it will check against the old algo as well.

This new option disables the fallback to the old algo, so it should be enabled ONLY if you know that your fingerprint was updated. Not enabled by default.

See https://threadreaderapp.com/thread/1339101572832382981.html for details about the fingerprint vulnerability.

Related issue (if applicable): fixes #10571

Checklist:

  • The pull request is done against the latest development branch
  • Only relevant files were touched
  • Only one feature/fix was added per PR and the code change compiles without warnings
  • The code change is tested and works on Tasmota core ESP8266 V.2.7.4.9
  • The code change is tested and works on Tasmota core ESP32 V.1.0.5-rc4
  • I accept the CLA.

NOTE: The code change must pass CI tests. Your PR cannot be merged unless tests pass

@s-hadinger s-hadinger merged commit f52f26f into arendst:development Jan 16, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Security enhancement: disable "old" fingerprint derivation by default
1 participant