[ZOOKEEPER-3696] Support alternative algorithms for ACL digest

• Type: Task
• Status: Closed
• Priority: Blocker
• Resolution: Fixed
• Fix Version/s: 3.7.0
• Component/s: security
• Labels: FIPS pull-request-available
• Assignee: Ling Mao
• Reporter: Patrick D. Hunt
• Created: 12/Jan/20 17:56
• Updated: 24/Nov/24 15:50
• Resolved: 02/Nov/20 16:59

Description

DigestAuthenticationProvider is using SHA1 which is known to be broken, eg recently:
https://shattered.io/
https://sha-mbles.github.io/
etc...

We should mark DigestAuthenticationProvider as deprecated at a minimum, perhaps even just remove it asap. The docs should also reflect this (ie don't use)

We could replace DigestAuthenticationProvider with DigestAuthenticationProvider3 or similar (use SHA3, not SHA2 if we do so) Or perhaps a version that allows the user to select? Regardless, would be good to give a simple option to the end user.

Issue Links

• is related to: ZOOKEEPER-3976 write a script to encapsulate DigestAuthenticationProvider as a tool to generate the digest with algorithm users appoint
• links to: GitHub Pull Request #1318