7 ms·
Changes Coming to TLS: Part Two
- okket 10y agoAlternative title: "Sanity Coming to TLS"
- Animats 10y agoYes. It's mostly about taking stuff out. Did OpenSSL take out the "debug feature" which bypasses encryption and logs keys if you set an environment variable?
- Kikawala 10y agoI don't know of an environment variable to enable that with OpenSSL, but there is one for NSS. For recent versions it has to be enabled at compile time, but it's enabled for the official Firefox binaries. https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/Key_Log_Format https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NS...
- walterbell 10y agoDo you have a pointer to that variable, code or doc? A web search didn't return anything obvious.
- dvorak42 10y agoSSLKEYLOGFILE is the one that a few implementations use.
- duskwuff 10y ago1. That feature is a feature of the OpenSSL implementation, not a feature of TLS itself. 2. It's also incredibly useful for debugging SSL implementations. (Much more so than as some sort of backdoor, since that's what you seem to be implying.)
- chillydawg 10y agoWithout that, you can't intercept https traffic and analyse it properly with tools like charles or wireshark. They both rely on reading the keyfile openssl et al write out when triggered to do so.
- FiloSottile 10y agoIf you prefer the video format, Nick and I gave a talk at 33c3 about how TLS 1.3 works and our experience deploying it at Cloudflare. https://media.ccc.de/v/33c3-8348-deploying_tls_1_3_the_great_the_good_and_the_bad https://media.ccc.de/v/33c3-8348-deploying_tls_1_3_the_great...
- newman314 10y agoWill Cloudflare be open sourcing the TLS 1.3 code to nginx or is this something we have to wait for nginx to add support to?
- hdhzy 10y agoMost of these changes seem to just disallow weak cipher suites and RTT-1/0 connections. Are there any other differences between modern TLS 1.2 setup and TLS 1.3?
- ninju 10y agoYou should read Part One of the series (https://access.redhat.com/blogs/766093/posts/2975791 https://access.redhat.com/blogs/766093/posts/2975791) which talks about the handshake changes
- snakeanus 10y agoIs there any reason not to use IPSec instead of TLS?
- yjftsjthsd-h 10y agoThey address totally different use cases.
- snakeanus 10y agoTo my knowledge both can be used for most use-cases. Do you have something specific in mind where TLS would shine but IPSec would not?
- throwaway2048 10y agoIPsec requires cooperation and setup from both the OS and any middleboxes. TLS typically does not. Putting it another way, TLS is actually usable in arbitrary applications, IPsec is definitely not.
- snakeanus 10y agoCurrent popular implementations of it. There is nothing technical in IPSec per se stopping it from being implemented as a library, userspace server, or anything like that. In reverse, IPSec is typically usable in arbitrary protocols and applications without special support for it, unlike TLS.
- throwaway2048 10y agoThings could always be different, but thats not a useful discussion when you are concerned about how things are, and working with them.
- deleted 10y ago[deleted]
- zedred 10y ago> If negotiating TLS 1.2, TLS 1.3 servers MUST set the last eight bytes of their Random value to the bytes: 44 4F 57 4E 47 52 44 01 If it is possible to do this safely, does that mean the TLS 1.2 Random value was always eight bytes too long? Or that it was unnecessary?
- yuhong 10y agoSSLv2-style ClientHellos typically used a 16 byte random. Current ones always use a 32 byte random.
- teddyh 10y agoAs I understand it, they are also removing raw public keys and OpenPGP keys, keeping only X.509 certificates.
- hdhzy 10y agoDid anyone use OpenPGP for this? Seems interesting...
- teddyh 10y agoThe project I co-designed still use this. It’s also supported by mod_gnutls for Apache.
- hdhzy 10y agoIs this only to check server identity or client as well? Why not use regular X 509 certs?
- teddyh 10y agoOnly server identity. Our situation in our project is that the TLS server side already has an OpenPGP key for other purposes anyway, so it is very practical to use it as an identity check inherent in the TLS handshake. On the topic of X.509 certificates, I can only point to Peter Gutmann: Everything you Never Wanted to Know about PKI but were Forced to Find Out (https://www.cs.auckland.ac.nz/~pgut001/pubs/pkitutorial.pdf https://www.cs.auckland.ac.nz/~pgut001/pubs/pkitutorial.pdf) Basically, X.509 certificates are very complex, and many security bugs have historically been found in the parsing code for them.
- snakeanus 10y agoWhich is quite sad since OpenPGP keys, unlike X.509 certificates, are allowed to carry signatures from multiple private keys instead of just one.
- hdhzy 10y agoFrom the github repo looks like raw public keys are supported but openpgp not : https://github.com/tlswg/tls13-spec/issues/929 https://github.com/tlswg/tls13-spec/issues/929 https://github.com/tlswg/tls13-spec/issues/937 https://github.com/tlswg/tls13-spec/issues/937
- vbtechguy 10y agoLooking forward to TLS 1.3. Starting testing Nginx 1.11.13 + OpenSSL 1.1.0 draft 18 branch with TLS 1.3 myself https://community.centminmod.com/posts/47692/ https://community.centminmod.com/posts/47692/ not quite there yet. Needs some love on Nginx end too :)