5 ms·

Here we go. Another round of "damn it, it's written in C. that's the root of all evil". I think by this point a Markov chain can easily generate responses to th

Here we go. Another round of "damn it, it's written in C. that's the root of all evil". I think by this point a Markov chain can easily generate responses to the OpenSSL/LibreSSL vulnerability announcements so we don't have to. Yes, C sucks because buffer overflows are still possible. That's by design. At the same time, it goes something like this: 1. OpenSSL (or this time LibreSSL) has a vulnerability discovered. 2. Everyone gets in an uproar about how we need a clean implementation in a language that prevents stupid errors. 3. Someone suggests unit testing. tptacek tells them to go away. 4. Someone actually points out a Haskell project (https://news.ycombinator.com/item?id=7557089 https://news.ycombinator.com/item?id=7557089). 5. People poo poo any alternative to OpenSSL because it's not 100% feature complete and besides the best crypto people are already working on OpenSSL so what do these schmucks know? 6. Someone points out that in higher level languages it's hard to write code that is resistant against timing attacks. The discussion dies. I see only two alternatives. Either as a community we actually stop bike shedding and throw our weight behind a project that might actually become a good alternative to OpenSSL, or we accept that the canonical TLS library will be written in C and have bugs that are periodically discovered and quickly patched.

dguido 11y ago
Don't forget these functional alternatives to OpenSSL: 1. OCaml-TLS (https://github.com/mirleft/ocaml-tls https://github.com/mirleft/ocaml-tls) [1] 2. miTLS (http://www.mitls.org/wsgi/home http://www.mitls.org/wsgi/home) 3. s2n (https://github.com/awslabs/s2n https://github.com/awslabs/s2n) [1] Home of the epic Bitcoin Pinata! http://ownme.ipredator.se/ http://ownme.ipredator.se/
- codygman 11y ago
  Don't forget: https://hackage.haskell.org/package/tls https://hackage.haskell.org/package/tls
briansmith 11y ago
> 5. People poo poo any alternative to OpenSSL because it's not 100% feature complete and besides the best crypto people are already working on OpenSSL so what do these schmucks know? Here's a strategy: Take OpenSSL, remove a bunch of stuff that almost nobody needs, rearrange the code to make it clearer. You will get BoringSSL. Take the BoringSSL code, remove more stuff that people outside of Google generally don't need. Temporarily remove the X.509 code and the TLS code so that you can remove even more stuff. Next, write bindings for the remaining code for a safe language like Rust, so that the replacement X.509 and TLS code can be written in the safer language, while still using the OpenSSL crypto code. Then, write the new X.509 code, focusing on what really is needed and ignoring all the extra cruft that was added to X.509 but which doesn't actually improve security. Then, over time, refactor the the language bindings so more code is written in the safe language and less code is written in C, with the goal of almost all the code that isn't implementing directly crypto algorithms being in the safe language. Then, add a good, clean TLS implementation in the safe language, that focuses on the good parts of TLS, and that avoids all the legacy cruft that makes TLS seem complicated. I've been doing an experiment along these lines. I've open sourced two parts so far: 1. https://github.com/briansmith/ring https://github.com/briansmith/ring 2. https://github.com/briansmith/webpki https://github.com/briansmith/webpki It is a big project, but I am pretty sure it is going to succeed.
briansmith 11y ago
> 6. Someone points out that in higher level languages it's hard to write code that is resistant against timing attacks. The discussion dies. This doesn't matter, because the code that should be resistant to timing attacks should be written in assembly language or a language specially designed for that purpose (that doesn't exist yet) anyway. High-level languages have ways of accessing code written in assembly language. Anyway, my point is that all these things are solvable.
- heinrich5991 11y ago
  Rust has some compiler plugin magic that can help you write code resistant to timing attacks.
- msbarnett 11y ago
  > This doesn't matter, because the code that should be resistant to timing attacks should be written in assembly language This would put you right back into buffer overflow territory...
  - dbaupp 11y ago
    It's unfortunate, but the approach would hopefully be to write the smallest possible primitives in assembly and then use a safer language for the rest of the code that either doesn't need constant time guarantees, or gets those guarantees by building on the primitives. This means that verification against these sort of basic attacks can be focused on a much smaller amount of code, rather than every single location in the whole code-base that manipulates memory (as in C). (And, one can go a step further: extract assembly from some higher-level language/DSL designed to create constant time code.) In any case, the code in question for this post doesn't seem to be written to be timing sensitive.
tptacek 11y ago
Hey, I'm not anti-unit-testing! I just think a TDD reimplementation of OpenSSL is a silly idea.

dguido 11y ago

Don't forget these functional alternatives to OpenSSL: 1. OCaml-TLS (https://github.com/mirleft/ocaml-tls https://github.com/mirleft/ocaml-tls) [1] 2. miTLS (http://www.mitls.org/wsgi/home http://www.mitls.org/wsgi/home) 3. s2n (https://github.com/awslabs/s2n https://github.com/awslabs/s2n) [1] Home of the epic Bitcoin Pinata! http://ownme.ipredator.se/ http://ownme.ipredator.se/

codygman 11y ago
Don't forget: https://hackage.haskell.org/package/tls https://hackage.haskell.org/package/tls

briansmith 11y ago

> 5. People poo poo any alternative to OpenSSL because it's not 100% feature complete and besides the best crypto people are already working on OpenSSL so what do these schmucks know? Here's a strategy: Take OpenSSL, remove a bunch of stuff that almost nobody needs, rearrange the code to make it clearer. You will get BoringSSL. Take the BoringSSL code, remove more stuff that people outside of Google generally don't need. Temporarily remove the X.509 code and the TLS code so that you can remove even more stuff. Next, write bindings for the remaining code for a safe language like Rust, so that the replacement X.509 and TLS code can be written in the safer language, while still using the OpenSSL crypto code. Then, write the new X.509 code, focusing on what really is needed and ignoring all the extra cruft that was added to X.509 but which doesn't actually improve security. Then, over time, refactor the the language bindings so more code is written in the safe language and less code is written in C, with the goal of almost all the code that isn't implementing directly crypto algorithms being in the safe language. Then, add a good, clean TLS implementation in the safe language, that focuses on the good parts of TLS, and that avoids all the legacy cruft that makes TLS seem complicated. I've been doing an experiment along these lines. I've open sourced two parts so far: 1. https://github.com/briansmith/ring https://github.com/briansmith/ring 2. https://github.com/briansmith/webpki https://github.com/briansmith/webpki It is a big project, but I am pretty sure it is going to succeed.

briansmith 11y ago

> 6. Someone points out that in higher level languages it's hard to write code that is resistant against timing attacks. The discussion dies. This doesn't matter, because the code that should be resistant to timing attacks should be written in assembly language or a language specially designed for that purpose (that doesn't exist yet) anyway. High-level languages have ways of accessing code written in assembly language. Anyway, my point is that all these things are solvable.

heinrich5991 11y ago
Rust has some compiler plugin magic that can help you write code resistant to timing attacks.
msbarnett 11y ago
> This doesn't matter, because the code that should be resistant to timing attacks should be written in assembly language This would put you right back into buffer overflow territory...
- dbaupp 11y ago
  It's unfortunate, but the approach would hopefully be to write the smallest possible primitives in assembly and then use a safer language for the rest of the code that either doesn't need constant time guarantees, or gets those guarantees by building on the primitives. This means that verification against these sort of basic attacks can be focused on a much smaller amount of code, rather than every single location in the whole code-base that manipulates memory (as in C). (And, one can go a step further: extract assembly from some higher-level language/DSL designed to create constant time code.) In any case, the code in question for this post doesn't seem to be written to be timing sensitive.

tptacek 11y ago

Hey, I'm not anti-unit-testing! I just think a TDD reimplementation of OpenSSL is a silly idea.