Please migrate to GnuTLS 2.0.0

[wrd002]

Currently VLC uses GnuTLS 1.6, which doesn't support SHA-2 family (SHA-256 / 384 / 512) certificate signatures. This means that VLC can't read content from our secure servers . Fortunately, GnuTLS 2.0.0 has just been released (2007-09-04), and does all of this.

Please upgrade!

TIA

Will

[Rémi Denis-Courmont]

To my understanding, TLS 1.2 is required to negociate any MAC beyond MD5 and SHA-1. TLS 1.2 is not yet published, and GnuTLS does explicitly say that its implementation is a draft.

[wrd002]

For MACs that may well be true (I'd have to check to be sure). However, what I was talking about aren't MACs (which check the bulk data flowing through the connection once it's established), but rather the hashes used to form the certificate signatures. These bind the certificate chain together, and are checked during the connection establishment phase. The details of verifying the certificate chain aren't specified as part of TLS; you can use the SHA-2 cert signatures I need support for quite happily in TLS 1.0, and actually our servers do just that. It's a coincidence that GnuTLS 2.0.0 happens to support TLS 1.1, as well as SHA-2 certificate signatures.

Will.

[Jean-Baptiste Kempf]

As far as contribs and windows is concerned, we can make the switch when Rémi says it is fine.

[Rémi Denis-Courmont]

For MACs that may well be true (I'd have to check to be sure). However, what I was talking about aren't MACs (which check the bulk data flowing through the connection once it's established), but rather the hashes used to form the certificate signatures.

VLC does not have any specific assumption/restriction on the x509 certificates. As for the GnuTLS version, it's not part of VLC; it uses whatever the system has.

[wrd002]

That doesn't seem to be true for the Windows build, though? a) Windows doesn't have a system copy of gnutls and b) the Windows libgnutls_plugin.dll is 1.7MB, whereas the linux libgnutls_plugin.so is about 23K. Now, I know Windows has a weight problem, but even so!

[funman]

the gnutls library is statically linked to the gnutls plugin, you can always do a win32 build with gnutls 2.0.0

cross compilation instructions can be found on wiki.videolan.org, or in INSTALL.win32

[DGMurdockIII]

needs to be updated again