Missing compatibility for sha384

makuru-org commented

2024-06-19 19:28:31 +00:00

(Migrated from github.com)

I have enabled that my bios only supports sha384 but i get following error:

measurement log didn't use sha1 or sha256 digests.

Is it possible to use sha384 with lanzaboot?

I have enabled that my bios only supports sha384 but i get following error: `measurement log didn't use sha1 or sha256 digests`. Is it possible to use sha384 with lanzaboot?

😕 1

RaitoBezarius commented

2024-06-19 19:58:12 +00:00

(Migrated from github.com)

Probably possible, but we need a way to test it and reproduce it in our CI, and it's a maintenance churn. Can you provide precise information on your hardware so we know what type of machine does this sort of stuff?

makuru-org commented

2024-06-19 20:00:19 +00:00

(Migrated from github.com)

Its a reconfigured framework 16, it, may not be worth the effort, for a slight security gain.

RaitoBezarius commented

2024-06-19 20:01:15 +00:00

(Migrated from github.com)

It is surprising to me that Framework 16" has no support for SHA256… I will look into that, thanks.

👎 1

makuru-org commented

2024-06-19 20:02:04 +00:00

(Migrated from github.com)

No it has but you can disable it.

RaitoBezarius commented

2024-06-19 20:03:29 +00:00

(Migrated from github.com)

Ah, I see, so you disabled SHA256 on purpose. Then, I recommend you to stick to SHA256 and not disable it, very few end implementations will be crypto-agile enough for SHA384 which doesn't bring that much to the play. And you earn currently no security by using SHA384 over SHA256.

We can keep it open and see what does it cost to support it, but I am inclined to say this is very low priority as a result.

Ah, I see, so you disabled SHA256 on purpose. Then, I recommend you to stick to SHA256 and not disable it, very few end implementations will be crypto-agile enough for SHA384 which doesn't bring that much to the play. And you earn currently no security by using SHA384 over SHA256. We can keep it open and see what does it cost to support it, but I am inclined to say this is very low priority as a result.

👍 2 😆 1

Rows
Columns

Missing compatibility for sha384 #366