[FFe] APT 24.04 crypto policy update
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| apt (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned | ||
| gnupg2 (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned | ||
Bug Description
I don't know if this will land before the feature freeze but I'm filing this in any case:
Our goal for 24.04 is to reject 1024-bit RSA repository signing keys. Work is ongoing in Launchpad to allow dual-signing PPAs and then resign all PPAs with a 4096-bit key.
This needs the following changes:
1) The gnupg upstream commit for https:/
2) APT needs to learn to pass the argument if supported
3) APT needs to learn to interpret the output
4) APT possibly may have to learn to issue warnings instead of errors for weak keys and pass the URL to the gpgv method to allow 1024-bit RSA keys over TLS connections, in case there are unforeseen issues with the PPA migration.
Signing key policy: We would like to adopt a signing key policy of
rsa>2048,
As a result we would like to reject
- RSA keys below 2048 bits
- DSA keys
- Unsafe ECC keys:
- NIST P-{256,384,521}
- Brainpool P-{256,384,512}
- secp256k1
Notes:
- DSA keys are not possible to use anymore due to the deprecation of SHA1 that happened years ago
- NIST and Brainpool and secp256k1 are not very popular, https:/
Timing wrt feature freeze and launchpad changes:
Launchpad changes won't be landing before feature freeze and it will take some more weeks to resign the repositories, hence we need to do uploads after FF to enable the error by default even if we ship the functionality before it.
| description: | updated |
| description: | updated |
| Changed in gnupg (Ubuntu): | |
| status: | New → Fix Committed |
| affects: | gnupg (Ubuntu) → gnupg2 (Ubuntu) |
| Łukasz Zemczak (sil2100) wrote | #1 |
| Julian Andres Klode (juliank) wrote | #2 |
| Changed in apt (Ubuntu): | |
| status: | New → Fix Committed |
| Launchpad Janitor (janitor) wrote | #3 |
| Changed in gnupg2 (Ubuntu): | |
| status: | Fix Committed → Fix Released |
| Launchpad Janitor (janitor) wrote | #4 |
| Changed in apt (Ubuntu): | |
| status: | Fix Committed → Fix Released |
Since it's past Feature Freeze and I see that the apt task is still New, I suppose looking at this FFe still makes sense, right?
I think this feels a bit like 'a lot' considering the ongoing time_t transition in the archive. What's the status of the timeline for Launchpad? Do we have the required apt changes staged and building somewhere already?