486969 - Separately disable hash algorithms in signatures on different types of documents

Status: RESOLVED INACTIVE

(NSS :: Libraries, enhancement, P5)

Description

[Nelson Bolyard (seldom reads bugmail)]

When I implemented bug 471539, Timeless asked (in bug 471539 comment 30) that 
we separate the permissions bit for certs from the permission bit for CRLs.  
In other fora, others have requested that we separate permission to use MD5 
for (intermediate) CA certs from permission to use it for EE certs.

I didn't do those things for bug 471539, because I felt under pressure to 
plug a vulnerability in a hurry.  But now I think we could do those things 
without much difficulty.

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

Attachment: Preliminary patch - not ready for prime time

This patch suggests one way to approach this.
This patch is incomplete, lacking defs in nss.defs and header file 
declarations for the new TellHash functions.

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 371174 [details] [diff] [review]
Preliminary patch - not ready for prime time

This patch is also incomplete in another respect.  
It doesn't touch the libPKIX version of this code. :(