hrmm.. i suspect github.com/illumos/illumos-gate/blo…mon/softAttributeUtil.c#L2834-L2837 is what's generating the error... though github.com/illumos/illumos-gate/blo…ommon/crypto/des/des_impl.h#L81-L82 suggests that maybe it should be ok with 128 bits as well...

though the keysize is coming from softSlotToken.c

and the 'relaxation' seems to have originated with 6831413

so my guess is maybe they just missed a spot?

also looks like google's pkcs11 test suite doesn't check that either

(granted we fail it miserably already)

though it's been a few years since i've touched any of it

we still have des enabled? "A CVE released in 2016, CVE-2016-2183 disclosed a major security vulnerability in DES and 3DES encryption algorithms. This CVE, combined with the inadequate key size of DES and 3DES, led to NIST deprecating DES and 3DES for new applications in 2017, and for all applications by the end of 2023."

do not fix it, drop it.

better question would be "for what"

tsoome: or if not drop it, then at least "turn it off in default installation"

alas, not everyone might/can/will update their hashes in legacy system(s). on the other side, it's 2023, 3DES is so '80s

it is not just about being '80s, it is security issue.

in early '80s the common security awareness was not as hight as it is today

today, if you have no security awareness, you should not be connected to network;)

i know of some *big* networks where they use public IPs on workstations and they do not have any firewall in place.

well, that alone is no problem, but if you add there "no patching" policy too, then it is problem.

patching can add only illusory sense of security. but probably still better than nothing (leaving apart the fact that on those big networks there are windows workstations and workers want to connect via RDP directly from home, without any VPN)

anyway, not my business. 3DES should be deprecated.

otis $work being one of them, there is just a basic global acl set

but unless you jump through hoops everything gets a pub ipv4

otis: so my vague recollection was that des was 80's, 3des was 90's. IMHO should be disabled by default but for things like file encryption, etc., there should be a "break glass to reenable DES/3DES to decrypt your advisor's old thesis data files" config option