Re: [SECURITY] Google announced first SHA-1 collision - how to we deal with it in OFBiz?

2017-02-24 Thread Taher Alkhateeb
In reference to earlier threads and discussions, I propose the following: 1- Make the encryption algorithm a parameter, not hard-coded into the system. 2- Implement a new stronger encryption algorithm. 3- Set the new algorithm as default. 4- Update our documentation to point existing users to

Re: [SECURITY] Google announced first SHA-1 collision - how to we deal with it in OFBiz?

2017-02-24 Thread Michael Brohl
Another good reference: https://shattered.it Regards, Michael Am 24.02.17 um 22:07 schrieb Michael Brohl: Hi everyone, Google announced the first SHA1 collision [1]. See [2] for in-depth explanations. It's recommended to migrate to safer cryptographic hashes such as SHA-2 or SHA-3 as soon

[SECURITY] Google announced first SHA-1 collision - how to we deal with it in OFBiz?

2017-02-24 Thread Michael Brohl
Hi everyone, Google announced the first SHA1 collision [1]. See [2] for in-depth explanations. It's recommended to migrate to safer cryptographic hashes such as SHA-2 or SHA-3 as soon as possible. See [3] for an overview of SHA. SHA-3 was announced as the official new standard [4]. Let's