Re: Proposal: Remove MD5 / SHA1 support from veriexec

[Taylor R Campbell <campbell+netbsd-tech-security%mumble.net@localhost>]

> Date: Tue, 22 Aug 2017 00:12:19 +0100
> From: Sevan Janiyan <venture37%geeklan.co.uk@localhost>
> 
> Hello,
> As a two part process, I propose we remove the ability to generate
> signatures using SHA1/MD5 with veriexecgen as a part of NetBSD 8.
> Then in HEAD for NetBSD 9, we remove support for these hashes from the
> remaining components & kernel configuration files.
> 
> Part 1:
> http://www.netbsd.org/~sevan/patch-veriexecgen.txt
> 
> Part 2:
> http://www.netbsd.org/~sevan/patch-veriexec-nomd5-sha1.txt
> 
> Thoughts / objections?

LGTM (including removing RMD160 at the same time)