SHA-1 deprecation: allow it in key exchange
By default, keep allowing SHA-1 in key exchange signatures. Disabling
it causes compatibility issues, especially with clients that use
TLS1.2 but don't send the signature_algorithms extension.
SHA-1 is forbidden in certificates by default, since it's vulnerable
to offline collision-based attacks.
diff --git a/ChangeLog b/ChangeLog
index 59fdf97..15e1b24 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -11,12 +11,9 @@
* Wipe stack buffers in RSA private key operations
(rsa_rsaes_pkcs1_v15_decrypt(), rsa_rsaes_oaep_decrypt).
Found by Laurent Simon.
- * SHA-1 deprecation: remove it from the default allowed hash
- algorithms for certificate verification and TLS 1.2 handshake
- signatures. It can be turned back on at compile time with
- MBEDTLS_TLS_DEFAULT_ALLOW_SHA1 or explicitly with ssl_conf functions.
- * Removed RIPEMD-160 from the default hash algorithms for
- certificate verification.
+ * Removed SHA-1 and RIPEMD-160 from the default hash algorithms for
+ certificate verification. SHA-1 can be turned back on with a compile-time
+ option if needed.
Bugfix
* Remove macros from compat-1.3.h that correspond to deleted items from most