Repository navigation
feat: classical strength for every detected algorithm (PRD-010) - #19
Merged
Merged
Conversation
Progress ticks from parallel probes could arrive out of order, and the progress write happened outside the lock, so the count shown during a scan could drop (CI: TestAC02_ProgressIsLiveAndScanCanBeCancelled saw 8 then 7). tick keeps the maximum under the lock, and message writes its event and progress under the lock.
A suite is as strong as its weakest part (OD-1): cipher, key exchange, certificate key and MAC, each rated by NIST's own method (GNFS for RSA and DH, SP 800-186 for curves, SP 800-57 for ciphers and hashes). - eval/9: the evaluation carries suiteStrength and keyStrength; stored scans are re-evaluated on start - report and PDF read the evaluation; both heuristic copies are gone - tls scan --details shows each suite's word, bits and weakest part - Inventory, SSH report: a Classical strength column - CBOM: algorithmProperties.classicalSecurityLevel (1.6 and 1.7) - single DES is Insecure (#18) - Help, methodology, cbom-model, README, CHANGELOG; QA-REPORT-010 Closes #17. Closes #18.
crypto/x509 in 1.27.2 does not distrust compromised intermediate certificates, and pki.Validate calls Certificate.Verify. Bumps the go.mod toolchain (which every workflow reads) and the Dockerfile's build image, pinned by digest.
On CI the fonts swapped in after the scroll and pushed the topic 214 px down (E2E-STR-3). Scroll again once document.fonts is ready.
CI places the Help topic 214 px from the top on every run (20 px locally): a layout difference, not timing. The check now states the requirement: the page scrolled and the heading is in the top third.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Builds the rest of ENH-001 as PRD-010, approved with OD-1 (a suite is as strong as its weakest part). Stacked work from #16 is already on main.
What changes
internal/eval/strength.go): each suite's parts (cipher, key exchange, certificate key, MAC) are rated by NIST's method, and the word follows PRD-010 §2. Single DES is Insecure (Single DES (56-bit) cipher suites are rated Weak, not Insecure #18), and RSA-2048 suites are Acceptable.suiteStrengthandkeyStrength, and SSH algorithms carrystrength. Moving toeval/9means stored scans are re-evaluated on start.tls scan --detailsshows each suite's word, bits and weakest part.algorithmProperties.classicalSecurityLevelis set, valid against the 1.6 and 1.7 schemas.TestAC02flaky on feat(algo): classical strength by NIST's method (ENH-001 spec and calculator) #16.QA
QA-REPORT-010:
go test ./...: all 44 packages pass.GOOS=linux.Closes #17. Closes #18.