)]}'
{
  "commit": "9295969e1dad2c31d0d99481734c1c68dcbc6403",
  "tree": "ad2e759f58557e766a02decdf8a2558ad14e8778",
  "parents": [
    "c5795a328880eadb879088fc59cd0087edc8dc20"
  ],
  "author": {
    "name": "David Benjamin",
    "email": "davidben@google.com",
    "time": "Thu May 22 13:11:22 2025 -0400"
  },
  "committer": {
    "name": "Boringssl LUCI CQ",
    "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "time": "Fri May 23 09:51:54 2025 -0700"
  },
  "message": "Update defaults for PKCS12_create\n\nEven the \"modern\" variants of the PKCS password-based private key\nencryption schemes are are not very modern. We largely do not treat them\nas load-bearing for security. Still, it\u0027s 2025, so we ought to upgrade\ntheir defaults up to late 90s and early 00s cryptography.\n\nThis matches OpenSSL upstream\u0027s new behavior:\n\n- The default MAC iteration count is 2048, not 1\n- The default encryption algorithm is PBES2 with AES-256-CBC, not 3DES\n  and 40-bit RC2\n- The PRF function for PBKDF2 inside PBES2 is HMAC-SHA256, not\n  HMAC-SHA1.\n\nUpdate-Note: The defaults for PKCS#12 are changed as above. They match\nupstream OpenSSL, so any systems compatible with OpenSSL will already be\ncompatible with this. The old defaults are still available by passing\nthem explicitly to PKCS12_create.\n\nThe one exception that OpenSSL\u0027s API does not have any way to change the\nPBKDF2 PRF hash in PKCS#12. We don\u0027t anticipate this being a concern.\nNote that this PRF change does not impact the old PBES1 schemes, only\nthe newer PBES2 schemes.\n\nFixed: 396434682\nChange-Id: I949966483ff96796b0f76dd10b059fc98ecdeae9\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/79527\nCommit-Queue: Adam Langley \u003cagl@google.com\u003e\nAuto-Submit: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "14868697f3d66685793ab1ae07bd82c4a9fc1b30",
      "old_mode": 33188,
      "old_path": "crypto/pkcs8/p5_pbev2.cc",
      "new_id": "5da0cdb8625244a3eee989322cc95c6b424de91f",
      "new_mode": 33188,
      "new_path": "crypto/pkcs8/p5_pbev2.cc"
    },
    {
      "type": "modify",
      "old_id": "c5abc756a7f88b8ad4c615ba41160f5875056147",
      "old_mode": 33188,
      "old_path": "crypto/pkcs8/pkcs8_x509.cc",
      "new_id": "5f5286f049be64f44491312b6429d6eedd75d613",
      "new_mode": 33188,
      "new_path": "crypto/pkcs8/pkcs8_x509.cc"
    },
    {
      "type": "modify",
      "old_id": "8693566829c017bd29a2c8d3a78e14d46ace6278",
      "old_mode": 33188,
      "old_path": "include/openssl/pkcs8.h",
      "new_id": "47847f88893659768e7e3446e65b348ab3f9e7a7",
      "new_mode": 33188,
      "new_path": "include/openssl/pkcs8.h"
    }
  ]
}