Re: [PATCH common 2/2] ticket: sign RSA tickets with SHA-256

["Shannon Sterz" <s.sterz@proxmox.com>]

On Fri Oct 23, 2026 at 8:57 PM CEST, Mark Atwood wrote:
> Crypt::OpenSSL::RSA signs with SHA-1 unless told otherwise. NIST SP
> 800-131A Rev. 2 no longer allows SHA-1 for creating digital signatures,
> and a FIPS provider that enforces this makes assemble_rsa_ticket die, so
> no ticket can be issued.
>
> Select SHA-256 explicitly before signing. The signature length only
> depends on the RSA key size, so tickets keep their size.
>
> Nodes with the previous commit accept both hashes. Nodes running an
> older version only verify SHA-1, so in a cluster with mixed versions a
> ticket issued by an updated node is rejected by a not yet updated one,
> for example on API requests that the updated node proxies to it. This
> change should thus only roll out once the verification side has been
> available for a while.

One thing I wonder is whether we should maybe make this an opt-in as it
can already break certain users' setups (as you mentioned). An opt-in
would allow users that require a FIPS provider to use this already
instead of having to wait for use decide when it's been "long enough".
We can then eventually remove the opt-in check move everyone over.

We could also write a file to `/etc/pve` that indicates what nodes of
the cluster are ready to use the new hash function and switch
automatically if all nodes are updated. This would handle this
automatically, but would be more complex to implement.

-->8 snip 8<--