{"action":"created","issue":{"url":"https://api.github.com/repos/friendica/friendica/issues/4442","repository_url":"https://api.github.com/repos/friendica/friendica","labels_url":"https://api.github.com/repos/friendica/friendica/issues/4442/labels{/name}","comments_url":"https://api.github.com/repos/friendica/friendica/issues/4442/comments","events_url":"https://api.github.com/repos/friendica/friendica/issues/4442/events","html_url":"https://github.com/friendica/friendica/issues/4442","id":296372467,"number":4442,"title":"Security: Drop unsecure OPENSSL_PKCS1_PADDING from openssl_private_decrypt()","user":{"login":"MrPetovan","id":925415,"avatar_url":"https://avatars1.githubusercontent.com/u/925415?v=4","gravatar_id":"","url":"https://api.github.com/users/MrPetovan","html_url":"https://github.com/MrPetovan","followers_url":"https://api.github.com/users/MrPetovan/followers","following_url":"https://api.github.com/users/MrPetovan/following{/other_user}","gists_url":"https://api.github.com/users/MrPetovan/gists{/gist_id}","starred_url":"https://api.github.com/users/MrPetovan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MrPetovan/subscriptions","organizations_url":"https://api.github.com/users/MrPetovan/orgs","repos_url":"https://api.github.com/users/MrPetovan/repos","events_url":"https://api.github.com/users/MrPetovan/events{/privacy}","received_events_url":"https://api.github.com/users/MrPetovan/received_events","type":"User","site_admin":false},"labels":[{"id":739003526,"url":"https://api.github.com/repos/friendica/friendica/labels/Enhancement","name":"Enhancement","color":"40ce79","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":18,"created_at":"2018-02-12T13:20:53Z","updated_at":"2018-02-17T01:51:43Z","closed_at":null,"author_association":"COLLABORATOR","body":"On a suggestion from @paragonie-scott, there's a known vulnerability in the standard PKCS1 padding and he is recommending to use OPENSSL_PKCS1_OAEP_PADDING instead. However, this isn't a backwards-compatible change, so we can only use it for internal communication (Diaspora is using the default padding as well but we can't change their side).\r\n\r\nHe offered to add a comment here detailing the best migration/fallback strategy.\r\n\r\nI believe I have to say his name three times.\r\n@paragonie-scott!\r\n@paragonie-scott!\r\n@paragonie-scott!"},"comment":{"url":"https://api.github.com/repos/friendica/friendica/issues/comments/366406087","html_url":"https://github.com/friendica/friendica/issues/4442#issuecomment-366406087","issue_url":"https://api.github.com/repos/friendica/friendica/issues/4442","id":366406087,"user":{"login":"MrPetovan","id":925415,"avatar_url":"https://avatars1.githubusercontent.com/u/925415?v=4","gravatar_id":"","url":"https://api.github.com/users/MrPetovan","html_url":"https://github.com/MrPetovan","followers_url":"https://api.github.com/users/MrPetovan/followers","following_url":"https://api.github.com/users/MrPetovan/following{/other_user}","gists_url":"https://api.github.com/users/MrPetovan/gists{/gist_id}","starred_url":"https://api.github.com/users/MrPetovan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MrPetovan/subscriptions","organizations_url":"https://api.github.com/users/MrPetovan/orgs","repos_url":"https://api.github.com/users/MrPetovan/repos","events_url":"https://api.github.com/users/MrPetovan/events{/privacy}","received_events_url":"https://api.github.com/users/MrPetovan/received_events","type":"User","site_admin":false},"created_at":"2018-02-17T01:51:43Z","updated_at":"2018-02-17T01:51:43Z","author_association":"COLLABORATOR","body":"I checked, we are using the default padding everywhere, especially with Diaspora since it's in their spec.\r\n\r\nI looked into the PHP bug, and it turns out OAEP padding only makes sense for assymetric encryption (public_encrypt/private_decrypt) but not for assymetric signing (private_encrypt/public_decrypt). I'll make sure not to confuse both when I'm working on this."}}
{"actor":{"display_login":"MrPetovan"}}