Date: Fri, 9 Feb 2018 19:07:38 +0100
From: Natanael Copa <ncopa@alpinelinux.org>
To: William Pitcock <nenolod@dereferenced.org>
Cc: Kevin Chadwick <m8il1ists@gmail.com>, alpine-dev
 <alpine-devel@lists.alpinelinux.org>
Subject: Re: [alpine-devel] Proposed change: openssl 1.1 as default system
 openssl implementation
Message-ID: <20180209190738.08862937@ncopa-macbook.copa.dup.pw>
In-Reply-To: <CA+T2pCFi7iAqSxq500VYS=3a2GYTkF0akWhy6oVpL7B7O1N-Ew@mail.gmail.com>
References: <CA+T2pCGFeh30aEi43hAvJ3yoHBijABy_U62wfjhVmf3FmbNUUg@mail.gmail.com>
	<20180208180544.3ff19e66@mechanicum.chadwicks.me.uk>
	<CA+T2pCFi7iAqSxq500VYS=3a2GYTkF0akWhy6oVpL7B7O1N-Ew@mail.gmail.com>
Precedence: list
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

On Thu, 8 Feb 2018 12:53:06 -0600
William Pitcock <nenolod@dereferenced.org> wrote:

> Hello,
> 
> On Thu, Feb 8, 2018 at 12:05 PM, Kevin Chadwick <m8il1ists@gmail.com> wrote:
> > On Thu, 8 Feb 2018 11:23:26 -0600
> >
> >  
> >> Meanwhile, the libressl guys have been removing
> >> functionality we depend on, such as support for hardware accelerators
> >> (ENGINE apis), switching from 64-bit TAIN date calculations to time_t
> >> (because time_t is good enough on OpenBSD) and dropping openssl 1.0.1
> >> APIs they see as unsuitable.  
> >
> > This is a strange take on the situation to say the least.  
> 
> I would argue that 32-bit systems not being able to validate
> certificates from CAs who have expiry dates past year 2038 is a major
> security problem.  This is caused by the elimination of the TAI64N
> date calculation code.

The fact that libressl developers are not willing to workaround 32 bit
linux time_t is the deal breaker for me. I am not happy to switch back
to openssl. I have been fairly happy with libressl and been willing to
sacrifice pretty much work for the extra security benefits libressl has
given, but the situation we are in now is that we have to choose
between:

- replace linux kernel with some other kernel
- do not support CAs with expiry date past year 2038
- drop 32 bit support
- replace libressl

I wish libressl could keep the 32 bit time_t workaround til linux
kernel had fixed the problem instead of knowingly break things. Now I
don't see we have much of an option since 32 bit linux is basically not
supported by libressl at this point.

-nc


---
Unsubscribe:  alpine-devel+unsubscribe@lists.alpinelinux.org
Help:         alpine-devel+help@lists.alpinelinux.org
---