SHA1/MD5 in IPFire

[IT Superhack <itsuperhack@web.de>]

[-- Attachment #1: Type: text/plain, Size: 1115 bytes --]

Hello Development-List,

hi, it's me again.

In the past, some ciphers and algorithms were broken, such as MD5, RC4,
DES and recently SHA1.

Because those are either weak or insecure, most experts recommend to
avoid them. But nothing big happend, near all websites still support RC4
or MD5, some certificates are still signed with SHA1 and so on.

Even in IPFire those are sill used in several categories:
1. On downloads.ipfire.org, the checksums use SHA1.
2. Until 2.17, the HTTPS certificate IPFire generated was signed with SHA1.

During the last ten minutes, I tried to set up an IPSec connection and
noticed that some of the used cryptographic technologies are
weak/insecure, such as:
1. The root certificate is RSA-2048 (RSA-4096 is better) and is signed
with SHA1.
2. Road-Warrior-Certificates are RSA-1024 (insecure) and signed with
MD5, which is also insecure.
3. SHA1 and MD5 are allowed for authenticating (see: advanced settings).

Since those endanger secure communication, it would be nice if MD5 & co.
could be avoided in IPFire.

Many thanks in advance,
Timmothy Wilson

P.S.: The Bug ID is #10763