Istio project that are using insecure hashing algo- rithms: • istio/istio/mixer/adapter/list/list.go (line 193) // determine whether the list has changed since the last fetch sha = sha1.Sum(buf) if sha == is unchanged") h.resetPurgeTimer() return } • istio/istio/mixer/pkg/runtime/handler/signature.go (line 80) 15 | Google Istio Security Assessment Google / NCC Group Confidential if encoded { sha := sha1 Sum(buf.Bytes()) pool.PutBuffer(buf) return sha } • istio/istio/mixer/pkg/config/store/fsstore.go (line 91) func parseFile(path string, data []byte) []*resource { chunks := bytes.Split(data, []byte("\n---\n"))

Experiences from running Istio in a k8s production environment Line Moseng @linemoseng Johnny Horvi Norwegian Labour and Welfare Administration 5,2 million nais.io github.com/nais CD CD metrics

independent streams ■ Extremely similar to HTTP/2, but in transport layer ● Improvements ○ TCP head of line blocking ○ Faster handshakes ○ Earlier data ○ Connection-ID ○ More encryption, always [1] Http3