Matthew McPherrin

Security issue: using HMAC on the passphrase directly is brute-forcable

1

I only briefly looked at the code after seeing it on lobste.rs, but it appears that this uses HMAC with a passphrase as the key directly. If you can get...

Issues with new admin tool

4

I've been testing out the new admin tool and have the following quality-of-life problems: Some are relatively straightforward tool fixes: * [x] #7358 * [x] #7357 * [x] https://github.com/letsencrypt/boulder/issues/7460 Some...

Support using an ALB between VA and RVA

2

We have a bit of fragility between the VA and RVA because of our use of DNS to locate RVA servers. As well, our private PKI needs to be stretched...

Allow specifying an account for `admin update-email`

6

update-email does a full table scan, but it could take an account to update and be efficient. The dry-run should print accounts found for use in a non-dry-run

Add lint for EV Guidelines section 9.7.3

3

This checks that EV certificates contain a CPS URI policy qualifier. The CPS URI should be a public HTTP URI. This requirement was included explicitly in the EV guidelines version...

Name ID tool

4

We need to calculate boulder's "NameID"s occasionally. Having a tool inside boulder source tree would be helpful (doesn't have to be built; something I can `go run` is fine) ```...

Using the ahrefs.com/broken-link-checker/, I noticed this link was dead. I don't see a replacement page on the website, so simply remove it.

Empty logs sign wrong root hash

2

Per @AGWA on https://groups.google.com/a/chromium.org/g/ct-policy/c/v9JzlbphYBs/m/-blS5vMtAgAJ > Note that all cryptographic operations (such as hashes and signatures) are as specified by RFC 6962, so these APIs can be thought of as an...

Merge challtestsrv package into Pebble

1

This moves the challtestsrv package into the Pebble source tree. All users of challtestsrv that I'm aware of also use Pebble, and having them in two repos means they're harder...