)]}'
{
  "commit": "cee2dbb08cb3daf56995875207b5e947310697de",
  "tree": "c10695ce6c6d69735ac37e89633f84128d2215a5",
  "parents": [
    "fa7afff95a7e490afc50c8b554dbd24e8e30101c"
  ],
  "author": {
    "name": "David Benjamin",
    "email": "davidben@google.com",
    "time": "Fri Apr 14 16:47:59 2023 -0400"
  },
  "committer": {
    "name": "Boringssl LUCI CQ",
    "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "time": "Mon Apr 17 18:16:47 2023 +0000"
  },
  "message": "Default SSL_set_enforce_rsa_key_usage to enabled.\n\nThis relands\nhttps://boringssl-review.googlesource.com/c/boringssl/+/54606, which was\ntemporarily reverted.\n\nUpdate-Note: By default, clients will now require RSA server\ncertificates used in TLS 1.2 and earlier to include the keyEncipherment\nor digitalSignature bit. keyEncipherment is required if using RSA key\nexchange. digitalSignature is required if using ECDHE_RSA key exchange.\n\nIf unsure, TLS RSA server signatures should include both, but some\ndeployments may wish to include only one if separating keys, or simply\ndisabling RSA key exchange. The latter is useful to mitigate either the\nBleichenbacher attack (from 1998, most recently resurfaced in 2017 as\nROBOT), or to strengthen TLS 1.3 downgrade protections, which is\nparticularly important for enterprise environments using client\ncertificates (aka \"mTLS\") because, prior to TLS 1.3, the TLS client\ncertificate flow was insufficiently encrypted or authenticated. Without\nreflecting an RSA key exchange disable into key usage, and then the\nclient checking it, an attacker can spoof a CertificateRequest as coming\nfrom some server.\n\nThis aligns with standard security requirements for using X.509\ncertificates, specified in RFC 5280, section 4.2.1.3, and reiterated in\nTLS as early as TLS 1.0, RFC 2246, section 7.4.2, published 24 years ago\non January 1999. Constraints on usage of keys are important to mitigate\ncross-protocol attacks, a class of cryptographic attacks that is\nwell-studied in the literature.\n\nWe already checked this for each of ECDSA, TLS 1.3, and servers\nverifying client certificates, so this just fills in the remaining hole.\nAs a result, this change is also important for avoiding some weird\nbehaviors when configuration changes transition a server in or out of\nthis hole. (We\u0027ve seen connection failures get misattributed to TLS 1.3\nwhen it was really a certificate misconfiguration.)\n\nChrome has also enforced this for some time with publicly-trusted\ncertificates. As a temporary measure for callers that need more time,\nthe SSL_set_enforce_rsa_key_usage API, added to BoringSSL in January\n2019, still exists where we need to turn this off.\n\nFixed: 519\nChange-Id: I91bf2cfb04c92aec7875e640f90ba6f837146dc1\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/58805\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Bob Beck \u003cbbe@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "c035825133e13bbd4c176b3547e8e02322842948",
      "old_mode": 33188,
      "old_path": "ssl/ssl_lib.cc",
      "new_id": "6b4549633585f8a65fb7b285a9be4ba83db355db",
      "new_mode": 33188,
      "new_path": "ssl/ssl_lib.cc"
    },
    {
      "type": "modify",
      "old_id": "54bb7b480569e381456cea28894704ff808efeca",
      "old_mode": 33188,
      "old_path": "ssl/test/runner/runner.go",
      "new_id": "dde60dfdf102a8db420619fb098a90a98dcd9d01",
      "new_mode": 33188,
      "new_path": "ssl/test/runner/runner.go"
    },
    {
      "type": "modify",
      "old_id": "09faf04e1e51fa7547b323f325d1fb261b1daaf0",
      "old_mode": 33188,
      "old_path": "ssl/test/test_config.cc",
      "new_id": "ba10a33190049d47cb166e4d34eb454d06d5de8d",
      "new_mode": 33188,
      "new_path": "ssl/test/test_config.cc"
    },
    {
      "type": "modify",
      "old_id": "5608dabd0344e58311fbef004369ef934508f185",
      "old_mode": 33188,
      "old_path": "ssl/test/test_config.h",
      "new_id": "5cc59264373a926f26ce111c966b09d8cbc84284",
      "new_mode": 33188,
      "new_path": "ssl/test/test_config.h"
    }
  ]
}