3 ms·

Why is this so hard? I'm honestly curious to know. The theory is extremely well laid out, i.e. it's just number theory. We know to do stuff in a way that avoids

Why is this so hard? I'm honestly curious to know. The theory is extremely well laid out, i.e. it's just number theory. We know to do stuff in a way that avoids side-channel attacks, i.e. try not to leak power usage when you're exponentiating, etc. Why do people keep using the awful mess that's openssl?

marssaxman 13y ago
What is the alternative?
- ghshephard 13y ago
  http://www.yassl.com/yaSSL/Home.html http://www.yassl.com/yaSSL/Home.html
  - nly 13y ago
    It's GPL, and, according to Wikipedia, doesn't support Secure Renegotiation[0]. [0] https://en.wikipedia.org/wiki/Comparison_of_TLS_Implementations#Extensions https://en.wikipedia.org/wiki/Comparison_of_TLS_Implementati...
- dkarapetyan 13y ago
  https://github.com/vincenthz/hs-tls https://github.com/vincenthz/hs-tls
tptacek 13y ago
It's not just number theory; it's a web of interlocking state machines implementing the TLS protocol, which itself depends on a variety of different marshalling formats for the number theoretic parameters, built on the shifting sands of optimizations for different machines, all evolved over the the course of ~15 years, starting from a package that was, literally, Eric Young's "teach myself C" project.
- nhaehnle 13y ago
  That's kind of missing the point though. It would be relatively easy to define an interface that is simple to use and allows implementing 90% of the use cases with rather low danger of shooting yourself in the foot. We know that this is possible because there are libraries out there that do it. This whole thread is about OpenSSL somehow failing to do that, despite being called out on it for years.
  - tptacek 13y ago
    I don't understand. What part of TLS are you calling "simple"?
    - nhaehnle 13y ago
      The interface between an application that wants to communicate using TLS and perform related tasks and a library that implements TLS can and should be simple - at least for the 90% of common use cases. The whole point of the original article is that the interface of OpenSSL is horrible and undocumented. Consider how the article's author was not originally interested in looking at the internals of OpenSSL. All they wanted was a decent and documented interface for dealing with certificates; if OpenSSL had exposed such an interface, they would never even have looked at the source code of its internals.
      - acqq 13y ago
        It's open source, everybody can decide to invest his own time to do the fixes. However, the functionality openssl provides is much bigger than most of the commenters can imagine. It's not easy at all.
- dkarapetyan 13y ago
  Ok, I can see the interlocking state machines introducing complexity that is unavoidable but the rest of it just seems like self-inflicted nonsense. I'm more than willing to take a performance hit and have a correct implementation that is easy to reason about in some high level language than one that every other week is shown to be broken because of some dangling pointer in some patch committed 2 years ago. I don't think I'm the only one with this opinion. I'm sure many others would take the performance hit just so they could have the piece of mind that the underlying crytopgraphic library securing their application's data is actually formally verified. The best part about the high level implementation is that it will only get better over time because of improvements in compiler technology. I'm not much of a conspiracy theorist but this one seems too well placed to be an accident and as long as people can't reason about the mess that is openssl stuff like this is gonna continue to slip in. We have formally verified browser kernels but yet we can't have something as fundamental as SSL/TLS be formally verified. The formally verified browser kernel: http://goto.ucsd.edu/quark/ http://goto.ucsd.edu/quark/. Edit: My google foo is very weak these days. Trending story is https://github.com/vincenthz/hs-tls https://github.com/vincenthz/hs-tls, an implementation of SSL/TLS in Haskell.
dijit 13y ago
inertia, it's what people know and too few people know it's internals to care. if every google search for "https apache" comes back with openssl examples, it will be what's deployed. personally I use gnutls for my irc servers, but, I'm the exception there. Those in the security community openly mock openssl due to the fact that it was a boys method of learning how SSL worked, which has been adopted but never properly structured... .. or that the 'openssl' command itself is actually supposed to be for development only.

marssaxman 13y ago

What is the alternative?

ghshephard 13y ago
http://www.yassl.com/yaSSL/Home.html http://www.yassl.com/yaSSL/Home.html
- nly 13y ago
  It's GPL, and, according to Wikipedia, doesn't support Secure Renegotiation[0]. [0] https://en.wikipedia.org/wiki/Comparison_of_TLS_Implementations#Extensions https://en.wikipedia.org/wiki/Comparison_of_TLS_Implementati...
dkarapetyan 13y ago
https://github.com/vincenthz/hs-tls https://github.com/vincenthz/hs-tls

tptacek 13y ago

It's not just number theory; it's a web of interlocking state machines implementing the TLS protocol, which itself depends on a variety of different marshalling formats for the number theoretic parameters, built on the shifting sands of optimizations for different machines, all evolved over the the course of ~15 years, starting from a package that was, literally, Eric Young's "teach myself C" project.

nhaehnle 13y ago
That's kind of missing the point though. It would be relatively easy to define an interface that is simple to use and allows implementing 90% of the use cases with rather low danger of shooting yourself in the foot. We know that this is possible because there are libraries out there that do it. This whole thread is about OpenSSL somehow failing to do that, despite being called out on it for years.
- tptacek 13y ago
  I don't understand. What part of TLS are you calling "simple"?
  - nhaehnle 13y ago
    The interface between an application that wants to communicate using TLS and perform related tasks and a library that implements TLS can and should be simple - at least for the 90% of common use cases. The whole point of the original article is that the interface of OpenSSL is horrible and undocumented. Consider how the article's author was not originally interested in looking at the internals of OpenSSL. All they wanted was a decent and documented interface for dealing with certificates; if OpenSSL had exposed such an interface, they would never even have looked at the source code of its internals.
    - acqq 13y ago
      It's open source, everybody can decide to invest his own time to do the fixes. However, the functionality openssl provides is much bigger than most of the commenters can imagine. It's not easy at all.
dkarapetyan 13y ago
Ok, I can see the interlocking state machines introducing complexity that is unavoidable but the rest of it just seems like self-inflicted nonsense. I'm more than willing to take a performance hit and have a correct implementation that is easy to reason about in some high level language than one that every other week is shown to be broken because of some dangling pointer in some patch committed 2 years ago. I don't think I'm the only one with this opinion. I'm sure many others would take the performance hit just so they could have the piece of mind that the underlying crytopgraphic library securing their application's data is actually formally verified. The best part about the high level implementation is that it will only get better over time because of improvements in compiler technology. I'm not much of a conspiracy theorist but this one seems too well placed to be an accident and as long as people can't reason about the mess that is openssl stuff like this is gonna continue to slip in. We have formally verified browser kernels but yet we can't have something as fundamental as SSL/TLS be formally verified. The formally verified browser kernel: http://goto.ucsd.edu/quark/ http://goto.ucsd.edu/quark/. Edit: My google foo is very weak these days. Trending story is https://github.com/vincenthz/hs-tls https://github.com/vincenthz/hs-tls, an implementation of SSL/TLS in Haskell.

dijit 13y ago

inertia, it's what people know and too few people know it's internals to care. if every google search for "https apache" comes back with openssl examples, it will be what's deployed. personally I use gnutls for my irc servers, but, I'm the exception there. Those in the security community openly mock openssl due to the fact that it was a boys method of learning how SSL worked, which has been adopted but never properly structured... .. or that the 'openssl' command itself is actually supposed to be for development only.