[DEPR]: Remove md4 caching and related ENABLE_BLAKE2B_HASHING feature flag #36024
Assignees
Labels
depr
Proposal for deprecation & removal per OEP-21
Comments
9 tasks
|
@feanil are you working on a PR for this? @Anas12091101 from our team could get started on one if you haven't. Presumably we have to wait for 2U's analysis in edx/edx-arch-experiments#872 before merging. |
|
@pdpinch I'd love it if @Anas12091101 can pick it up, happy to review! |
|
Working on it. I'll create a PR soon |
|
edx.org has been switched over to blake2b, so 2U is ready for this DEPR to proceed. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Proposal Date
2025-02-10
Target Ticket Acceptance Date
2025-01-10
Earliest Open edX Named Release Without This Functionality
Teak - 2025-04
Rationale
md4 hashing is discouraged and not secure. Although security is not a concern in this usage, supporting libraries and systems are removing support as well.
The setting
ENABLE_BLAKE2B_HASHINGwas added to allow operators to control the timing of this change but once everyone has changed, it is no longer necessary.Removal
The code introduced in #34442 needs to be removed
Replacement
md4 hashing is replaced by blake2b, a widely supported algorithm.
Deprecation
No response
Migration
No migration is necessary. The cache will re-fill without intervention. The setting was introduced solely to allow operators to control the timing of the cache re-fill, against the possibility that it could degrade performance.
Additional Info
No response
Task List
No response
Links
The text was updated successfully, but these errors were encountered: