Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8282649

Disable http DIGEST mechanism with MD5 by default

XMLWordPrintable

    • Icon: CSR CSR
    • Resolution: Approved
    • Icon: P3 P3
    • 19
    • core-libs
    • None
    • behavioral
    • medium
    • Hide
      HTTP Digest is probably not that widely used, but it is possible that users of it will encounter this considering that it is an old spec, and MD5 was the only mandated algorithm for a long time. But, users may appreciate being informed of the security risk and the logging message will describe the issue and how to re-enable the functionality if required. SHA-1 is also being disabled by default but probably was not widely used (if at all).
      Show
      HTTP Digest is probably not that widely used, but it is possible that users of it will encounter this considering that it is an old spec, and MD5 was the only mandated algorithm for a long time. But, users may appreciate being informed of the security risk and the logging message will describe the issue and how to re-enable the functionality if required. SHA-1 is also being disabled by default but probably was not widely used (if at all).
    • System or security property

      Summary

      Disable by default the MD5 message digest algorithm in HTTP Digest authentication, and define a new system property to re-enable this or any other such disabled algorithms. SHA-1 will also be disabled at this time.

      Problem

      MD5 is accepted as an insecure digest algorithm and is deprecated in RFC 7616. We need to disable its use by default while allowing users to opt in to using it if required. SHA-1 is also being disabled.

      Solution

      By default, if a HTTP server proposes MD5, or SHA-1 then the HTTP request will fail with an IOException describing the issue. In addition a message will be logged with more information including how to re-enable the algorithm.

      Specification

      Add the following text to net-properties.html

          <LI><P><B>{@systemProperty http.auth.digest.reEnabledAlgorithms}</B> (default: &lt;none&gt;)<BR>
          By default, certain message digest algorithms are disabled for use in HTTP Digest
          authentication due to their proven security limitations. This only applies to proxy
          authentication and plain-text HTTP server authentication. Disabled algorithms are still
          usable for HTTPS server authentication. The default list of disabled algorithms is specified
          in the {@code java.security} properties file and currently comprises {@code MD5} and
          {@code SHA-1}. If it is still required to use one of these algorithms, then they can be
          re-enabled by setting this property to a comma separated list of the algorithm names.</P> 

      Add the following to the java.security properties file

      #
      # Disabled message digest algorithms for use with plaintext
      # HTTP Digest authentication (java.net.HttpURLConnection).
      # This includes HTTPS Digest authentication to proxies.
      # This may be overridden by setting the networking (or system)
      # property "http.auth.digest.reEnabledAlgorithms" to a comma
      # separated list of algorithms to be allowed.
      #
      http.auth.digest.disabledAlgorithms = MD5, SHA-1

            michaelm Michael McMahon
            mullan Sean Mullan
            Daniel Fuchs
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved: