PHP Wiki

rfc:distrust-sha1-certificates - Change from signature_algorithms to security_level

kelunik — 2016-11-28T17:14:14+01:00

1480175254		current
Line 1:		Line 1:
	====== PHP RFC: Distrust SHA-1 Certificates ======		====== PHP RFC: Distrust SHA-1 Certificates ======

-	* Version: 0.1	+	* Version: 0.2
	* Date: 2016-11-25		* Date: 2016-11-25
		+	* Last Update: 2016-11-28
	* Author: Niklas Keller <me@kelunik.com>		* Author: Niklas Keller <me@kelunik.com>
	* Status: Under Discussion		* Status: Under Discussion
Line 9:		Line 10:
	===== Introduction =====		===== Introduction =====

-	As of 2016-01-01, the CA/B Forum forbids issuing new SHA-1 certificates. The CA/B has advised CAs starting 2015-01-16 to issue no SHA-1 certificates with an expiration date greater than 2017-01-01, as browsers had already announced (see references) to deprecate and remove SHA-1. [[http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r4.pdf\|NIST recommends that SHA-1 should no longer be used for digital signatures]]. Starting with Java 9, [[http://openjdk.java.net/jeps/288\|Java will also no longer accept SHA-1 starting 2017-01-01 by default]]. [[http://php.net/manual/en/context.ssl.php\|PHP does not even provide a context option]], yet.	+	As of 2016-01-01, the CA/B Forum forbids issuing new SHA-1 certificates. The CA/B has advised CAs starting 2015-01-16 to issue no SHA-1 certificates with an expiration date greater than 2017-01-01, as browsers had already announced (see references) to deprecate and remove SHA-1. [[http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r4.pdf\|NIST recommends]] that SHA-1 should no longer be used for digital signatures. Starting with Java 9, [[http://openjdk.java.net/jeps/288\|Java will also no longer accept SHA-1]] starting 2017-01-01 by default.
		+
		+	Meanwhile, PHP doesn't have any restrictions here at all. There's [[http://php.net/manual/en/context.ssl.php\|no context option]] that let's users specify which signature algorithms they accept. Even worse, PHP currently seems to accept even MD5 certificates.

	===== Proposal =====		===== Proposal =====

-	This RFC proposes to add a new ''"ssl"'' context option (''"signature_algorithms"'') that defines the accepted algorithms. This context option defaults to SHA-1 and SHA-2 in PHP 5.6, 7.0 and 7.1. Starting with PHP 7.2, this will default to SHA-2 only.	+	This RFC proposes to use [[https://www.openssl.org/docs/man1.1.0/ssl/SSL_CTX_set_security_level.html\|OpenSSL's new security level]] to restrict the accepted certificates. The RFC proposes to set this level to ''2'' if OpenSSL 1.1 is available, otherwise those rules are enforced by PHP itself. Quoting from the above manual page, this security level has the following effect:

-	==== Default for 5.6, 7.0 and 7.1 ====	+	> Security level set to 112 bits of security. As a result RSA, DSA and DH keys shorter than 2048 bits and ECC keys shorter than 224 bits are prohibited. In addition to the level 1 exclusions any ciphersuite using RC4 is also prohibited. SSL version 3 is also not allowed. Compression is disabled.

-	<code php>	+	This will be implemented as a new ''"ssl"'' context option named ''"security_level"'' using the same values as OpenSSL, it defaults to ''2'' starting 2017-01-01.
-	"RSA+SHA1:DSA+SHA1:ECDSA+SHA1" .	+
-	"RSA+SHA224:DSA+SHA224:ECDSA+SHA224:" .	+
-	"RSA+SHA256:DSA+SHA256:ECDSA+SHA256:" .	+
-	"RSA+SHA384:DSA+SHA384:ECDSA+SHA384:" .	+
-	"RSA+SHA512:DSA+SHA512:ECDSA+SHA512"	+
-	</code>	+
-		+
-	==== Default for 7.2 ====	+
-		+
-	<code php>	+
-	"RSA+SHA224:DSA+SHA224:ECDSA+SHA224:" .	+
-	"RSA+SHA256:DSA+SHA256:ECDSA+SHA256:" .	+
-	"RSA+SHA384:DSA+SHA384:ECDSA+SHA384:" .	+
-	"RSA+SHA512:DSA+SHA512:ECDSA+SHA512"	+
-	</code>	+

	===== Backward Incompatible Changes =====		===== Backward Incompatible Changes =====

-	SHA-1 certificates are no longer accepted by default starting in PHP 7.2. This change already happens to be almost a year late, as PHP 7.2 is expected to be released near 2017-12-01. This change is justified by the new CA/B rules, browser changes and thus industry standards.	+	MD5 and SHA-1 certificates are no longer accepted by default starting 2017-01-01. This break is intentional and is in line with the CA/B rules and major browser policies.

	===== Proposed PHP Version(s) =====		===== Proposed PHP Version(s) =====

-	PHP 5.6, 7.0, 7.1 and 7.2. Only 7.2 defaults to the new behavior.	+	All supported versions, because of the security impact.

	===== RFC Impact =====		===== RFC Impact =====

-	None expected. Browsers already start on 2017-01-01 with no longer accepting SHA-1 certificates. PHP 7.2 will be released long after 2017-01-01.	+	Browsers start on 2017-01-01 with no longer accepting SHA-1 certificates, too. Impact is expected to be rather low. People in need of SHA-1 certificates, e.g. for private CAs, can set the mentioned context option to ''0'' to get the previous behavior, but are strongly discouraged to do so.

	===== Future Scope =====		===== Future Scope =====

-	Once SHA-2 should be become obsolete, the default can be adjusted accordingly.	+	The default can be increased later should the need arise.

	===== Proposed Voting Choices =====		===== Proposed Voting Choices =====
Line 71:		Line 59:

	===== Rejected Features =====		===== Rejected Features =====
-	Keep this updated with features that were discussed on the mail lists.	+
		+	* Default value for ''signature_algorithms''

rfc:arrayiterator-improvements

wesnetmo — 2016-11-25T20:09:54+01:00

1480021825		current
Line 17:		Line 17:
	The existing method ''ArrayIterator::seek($position)'' searches for the Entry in a linear manner, and this is not ideal for many uses, as what it does is simply iterating over the array (or part of it) to reach the specified position (or key, assuming the array is a list). Instead, the proposed method ''ArrayIterator::seekKey($key)'' would be a ''O(1)'' operation as the cursor can immediately jump to the Entry identified by the given ''$key''.		The existing method ''ArrayIterator::seek($position)'' searches for the Entry in a linear manner, and this is not ideal for many uses, as what it does is simply iterating over the array (or part of it) to reach the specified position (or key, assuming the array is a list). Instead, the proposed method ''ArrayIterator::seekKey($key)'' would be a ''O(1)'' operation as the cursor can immediately jump to the Entry identified by the given ''$key''.

-	Specifically, if the given key is present in the array the method would successfully return ''null''; subsequent calls to ''ArrayIterator::current()'' would get the value associated with the specified ''$key'', ''ArrayIterator::key()'' would get ''$key'' and so on, like it would normally behave when iterating over the Entry. Instead, if the provided key is not present in the array, and exactly like ''ArrayIterator::seek($position)'', the method would throw a ''OutOfBoundsException'' and keep the current ''ArrayIterator'''s cursor state.	+	Specifically, if the given key is present in the array the method would successfully execute such that subsequent calls to ''ArrayIterator::current()'' would get the value associated with the specified ''$key'', ''ArrayIterator::key()'' would get ''$key'' and so on, like it would normally behave when iterating over the Entry. Instead, if the provided key is not present in the array, and exactly like ''ArrayIterator::seek($position)'', the method would throw a ''OutOfBoundsException'' and keep the current ''ArrayIterator'''s cursor state.

	===== ArrayIterator::prev():void =====		===== ArrayIterator::prev():void =====

rfc:object-typehint - added 3v4l.org link

brzuchal — 2016-11-23T11:34:10+01:00

1479879957		current
Line 290:		Line 290:
	===== Patches and Tests =====		===== Patches and Tests =====
	* PR[[https://github.com/php/php-src/pull/2080\|#2080]]		* PR[[https://github.com/php/php-src/pull/2080\|#2080]]
		+	* Online Runtime Execution at [[https://3v4l.org/\|3v4l.org]] on tab "RFC Branches"

usergroups:handbook:resources - created

heiglandreas — 2016-11-23T08:54:31+01:00

	current
Line 1:	Line 1:
	+	====== Resources ======

	+	Some resources about running a usergroup
	+
	+	* https://php.ug/ug/tips
	+	* https://hackernoon.com/how-to-run-a-meetup-297ef448d157#.7w5stody9

usergroups:handbook - Adds resources-link

heiglandreas — 2016-11-23T08:52:58+01:00

1386856293		current
Line 11:		Line 11:
	- [[usergroups:handbook:sponsorship\|Sponsorship]]		- [[usergroups:handbook:sponsorship\|Sponsorship]]
	- [[usergroups:handbook:finding_a_venue\|Finding a venue]]		- [[usergroups:handbook:finding_a_venue\|Finding a venue]]
-	- [[usergroups:handbook:promotion\|Promoting the user group]]	+	- [[usergroups:handbook:promotion\|Promoting the User Group]]
		+	- [[usergroups:handbook:resources\|Resources for starting and running a User Group]]

rfc

krakjoe — 2016-11-23T06:46:40+01:00

1480074055		current
Line 15:		Line 15:
	This section is for RFCs that have been announced on the PHP "internals" mail list.		This section is for RFCs that have been announced on the PHP "internals" mail list.

		+	* [[rfc:distrust-sha1-certificates\|Distrust SHA-1 Certificates]] \\ Distrust SHA-1 starting in PHP 7.2 (Created: 2016-11-25)
	* [[rfc:object-typehint\|Object typehint]] \\ Proposes adding ''object'' type-hint and return-type (Created: 2016-08-12)		* [[rfc:object-typehint\|Object typehint]] \\ Proposes adding ''object'' type-hint and return-type (Created: 2016-08-12)
	* [[rfc:arrayiterator-improvements\|ArrayIterator improvements]] \\ Proposes adding ''ArrayIterator::seekKey()'' and ''ArrayIterator::prev()'' (Created: 2016-11-21)		* [[rfc:arrayiterator-improvements\|ArrayIterator improvements]] \\ Proposes adding ''ArrayIterator::seekKey()'' and ''ArrayIterator::prev()'' (Created: 2016-11-21)
Line 84:		Line 85:
	This section is for early drafts of RFCs that have NOT been announced on the PHP "internals" mail list.		This section is for early drafts of RFCs that have NOT been announced on the PHP "internals" mail list.

-	* [[rfc:distrust-sha1-certificates\|Distrust SHA-1 Certificates]] \\ Default to SHA-256 only in PHP 7.2 (Created: 2016-11-25)
	* [[rfc:user_defined_session_serializer\|User defined session serializer]] \\ Implement user defined session serializer interface (Created: 2016-11-17)		* [[rfc:user_defined_session_serializer\|User defined session serializer]] \\ Implement user defined session serializer interface (Created: 2016-11-17)
	* [[rfc:replace_parse_url\|Create URLParser and URLBuilder Classes]] \\ Proposed improvement beyond what parse_url() allows Created: 2016-10-04)		* [[rfc:replace_parse_url\|Create URLParser and URLBuilder Classes]] \\ Proposed improvement beyond what parse_url() allows Created: 2016-10-04)

todo:php71 - ga date

krakjoe — 2016-11-22T19:20:16+01:00

1467747424		current
Line 24:		Line 24:
	\| Oct 27 2016 \| RC 5 \|		\| Oct 27 2016 \| RC 5 \|
	\| Nov 10 2016 \| RC 6 \|		\| Nov 10 2016 \| RC 6 \|
-	\| Nov 2? 2016 \| ? \|	+	\| Dec 1 2016 \| GA \|

	===== Release Managers =====		===== Release Managers =====

rfc:davey_shafik_on_twitter_thinking_about_an_rfc_to_remove_pear_from_php_8_0_thoughts_.png - created

davey — 2016-09-01T18:45:51+01:00

	current

rfc:screenshot_from_2016-08-05_14-24-16.png - created

yohgaki — 2016-08-05T07:24:56+01:00

	current

rfc:screenshot_from_2016-08-05_11-25-01.png - created

yohgaki — 2016-08-05T04:30:36+01:00

	current

rfc:array_change_keys_bench1.png - created

colinodell — 2016-05-31T03:13:02+01:00

	current

rfc:array_change_keys_bench2.png - created

colinodell — 2016-05-31T03:13:02+01:00

	current

rfc:array_change_keys_benchmark.png - created

colinodell — 2016-05-29T14:49:48+01:00

	current

vcs:php-merge-4.png - created

ab — 2015-09-15T14:10:48+01:00

	current

vcs:php-merge-3.png - created

ab — 2015-09-15T10:26:49+01:00

	current

doc:phdoe_login.png

yannick — 2014-08-01T14:31:26+01:00

1406059415	current

doc:phdoe_file_error.png

yannick — 2014-07-23T14:14:15+01:00

1302087566	current

doc:phdoe_need_update.png

yannick — 2014-07-23T14:04:48+01:00

1302087566	current

doc:phdoe_need_translate.png

yannick — 2014-07-23T13:54:07+01:00

1302087566	current

rfc:java-example-big.png - created

krakjoe — 2013-11-30T11:35:13+01:00

	current

1386856293		current
Line 11:		Line 11:
	- [[usergroups:handbook:sponsorship\|Sponsorship]]		- [[usergroups:handbook:sponsorship\|Sponsorship]]
	- [[usergroups:handbook:finding_a_venue\|Finding a venue]]		- [[usergroups:handbook:finding_a_venue\|Finding a venue]]
-	- [[usergroups:handbook:promotion\|Promoting the user group]]	+	- [[usergroups:handbook:promotion\|Promoting the User Group]]
		+	- [[usergroups:handbook:resources\|Resources for starting and running a User Group]]