Christopher Klooz

Secure PBKDF2 use

1

First, thank you for maintaining this wonderful tool! **Is your feature request related to a problem? Please describe.** PBKDF2-HMAC-SHA1 is no longer recommended, and may become a problem if there...

This is indirectly related to the bugzilla issue [Hardware without AES-NI: use xchacha12/Adiantum instead of AES-XTS](https://bugzilla.redhat.com/show_bug.cgi?id=2077532). If the availability of AES-NI is checked to choose the most appropriate disk encryption...

Insecure use of ed25519

1

Bernstein's python3 reference implementation of ed25519 is not appropriate for production purposes as it makes the python interpreter run functions for which that interpreter is not (cryptographically) designed, creating realistic...

Introduce possibility to use SHA1 instead of MD5 to use hardware acceleration

7

Hardware acceleration for SHA1 was introduced by the manufacturers around 2016-2019 in their architectures (including low-power architectures like Atom; and even Raspberry Pi supports it already since 3B). Most SHA1...

Hardware without AES-NI: use xchacha12/Adiantum instead of AES-XTS

12

This is a re-opening of https://bugzilla.redhat.com/show_bug.cgi?id=2077532 (I guess blivet handles tickets preferably here on GitHub? ;) This report was written during the F35 release cycle, but still applies (also, feel...

**Describe the bug** Once SELinux's 'confined user' [1] accounts are used, toolbox does no longer work on Fedora and CentOS: The issue is not logged in journalctl, neither at user...

Replace MD5 with xxhash

6

DNF still uses MD5 for error correction after downloading. I suggest to replace MD5 with xxhash or another comparable algorithm. This will improve the performance. Given that there is a...

Tooling for cryptography: a simple but effective approach?

3

I think security awareness is a big issue that has to be considered: I am not worrying about developers who are no security experts, but developers who are no security...