1219185 - please update pins for torproject.org

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[persona.org]

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Firefox/38.0 Iceweasel/38.3.0
Build ID: 20150922225347




Expected results:

1) Please update the pins for any of the existing torproject.org pins to
   allow chains through  Let’s Encrypt Authority X1 and Let’s Encrypt
   Authority X2.

2) please update the sha1 hashes for our contingency keys to sha2-256.
   Hashes have been provided by email to cviecco@ on 08 Feb 2014, but
   here they are once more:


weasel@valiant:/tmp/tor$ for i in *; do echo "$i:"; for h in sha1sum sha256sum; do d=$(cat $i | tail -n +2 | head -n -1 | base64 -d | $h | awk '{print $1}'); echo -e "  $h:\n    $d\n    $(echo $d | 16264)"; done; done
contingency-key-2011-1.pem:
  sha1sum:
    8ee371493bfd500366a42f6417918aa6658dc776
    juNxSTv9UANmpC9kF5GKpmWNx3Y=
  sha256sum:
    6d8cfd2530e4f3d5f7aaeddf82cc06fa5050b28e6f2343757f4471e20a389cba
    bYz9JTDk89X3qu3fgswG+lBQso5vI0N1f0Rx4go4nLo=
contingency-key-2011-2.pem:
  sha1sum:
    9626b8de53e897348f548ab7e03c39eee61c2c3f
    lia43lPolzSPVIq34Dw57uYcLD8=
  sha256sum:
    c570b1853767eeec579de2526d00aaa00bee5b766d425da90d54dfdac7b04bcc
    xXCxhTdn7uxXneJSbQCqoAvuW3ZtQl2pDVTf2sewS8w=
contingency-key-2011-3.pem:
  sha1sum:
    af313240828e87bee3f3b9f96e3594360b9717c6
    rzEyQIKOh77j87n5bjWUNguXF8Y=
  sha256sum:
    0a5782d6ac1447c24f807d675ef49ed951f10dee7f29f36cf7a12eb1b7d239fa
    CleC1qwUR8JPgH1nXvSe2VHxDe5/KfNs96EusbfSOfo=


The public key files can be provided on request.

Comment 1

[Dana Keeler (she/her) [:keeler]]

Is this change also happening in Chrome? If so, there's no additional work necessary, since Firefox will automatically incorporate those changes.

Comment 2

[persona.org]

(In reply to David Keeler [:keeler] (use needinfo?) from comment #1)
> Is this change also happening in Chrome? If so, there's no additional work
> necessary, since Firefox will automatically incorporate those changes.

Yes, this change should go into chrome eventually.

Cheers,
weasel

Comment 3

[Dana Keeler (she/her) [:keeler]]

Looks like the SHA-256 update happened in https://hg.mozilla.org/mozilla-central/rev/7d079eb4449b (landed in 46) and the Let's Encrypt additions happened in https://hg.mozilla.org/mozilla-central/rev/291bf32f6341 (landed in 45).