| commit | 3a322f5e4837a0c761d1a64f1bfea82a19f44e45 | [log] [tgz] |
|---|---|---|
| author | David Benjamin <davidben@google.com> | Wed Oct 26 12:45:35 2016 -0400 |
| committer | Adam Langley <agl@google.com> | Wed Oct 26 17:20:19 2016 +0000 |
| tree | 1bf64b11fe834b683cc777a6fafc5514364bb9e9 | |
| parent | 9415a14acf8ea9e84118f1b1ab1f0d97a3de1d19 [diff] |
Revise signing preferences. We currently preferentially sign the largest hash available and advertise such a preference for signatures we accept. We're just as happy with SHA-256 and, all else equal, a smaller hash would be epsilon more performant. We also currently claim, in TLS 1.3, we prefer P-384 over P-256 which is off. Instead order SHA-256 first, next the larger SHA-2 hashes, and leave SHA-1 at the bottom. Within a hash, order ECDSA > RSA-PSS > RSA-PKCS1. This has the added consequence that we will preferentially pair P-256 with SHA-256 in signatures we generate instead of larger hashes that get truncated anyway. Change-Id: If4aee068ba6829e8c0ef7948f56e67a5213e4c50 Reviewed-on: https://boringssl-review.googlesource.com/11821 Reviewed-by: Adam Langley <agl@google.com>
BoringSSL is a fork of OpenSSL that is designed to meet Google's needs.
Although BoringSSL is an open source project, it is not intended for general use, as OpenSSL is. We don't recommend that third parties depend upon it. Doing so is likely to be frustrating because there are no guarantees of API or ABI stability.
Programs ship their own copies of BoringSSL when they use it and we update everything as needed when deciding to make API changes. This allows us to mostly avoid compromises in the name of compatibility. It works for us, but it may not work for you.
BoringSSL arose because Google used OpenSSL for many years in various ways and, over time, built up a large number of patches that were maintained while tracking upstream OpenSSL. As Google's product portfolio became more complex, more copies of OpenSSL sprung up and the effort involved in maintaining all these patches in multiple places was growing steadily.
Currently BoringSSL is the SSL library in Chrome/Chromium, Android (but it's not part of the NDK) and a number of other apps/programs.
There are other files in this directory which might be helpful: