4 ms·
I can't believe how bad some of the findings were. From smacktls.com - "JSSE clients allow the peer to skip all messages related to key exchange and authentica
by amckenna 12y ago
I can't believe how bad some of the findings were.
From smacktls.com - "JSSE clients allow the peer to skip all messages related to key exchange and authentication. In particular, a network attacker can send the certificate of any arbitrary website, and skip the rest of the protocol messages. A vulnerable JSSE client is then willing to accept the certificate and start exchanging unencrypted application data. In other words, the JSSE implementation of TLS has been providing virtually no security guarantee (no authentication, no integrity, no confidentiality) for the past several years."
To reiterate - The JSSE implementation of TLS has been providing virtually no security guarantee for the past _several years_.
JSSE - the Java implementation of TLS shipped with the JDK.
I guess the silver lining in all of this is now we have a decent way to fuzz the TLS state machine which will hopefully prevent things like this in the future.
- ivanr 12y agoI think the most important lesson from the last couple of years is that all our security protocols must come with adversarial testing suites -- from inception. Clearly, there's a long way between designing a secure protocol (I am not saying that SSL and TLS were properly designed) and implementing one.
- amckenna 12y agoYeah I would have hoped that tests involving skipped or out of order protocol flows would have been part of their normal functional testing. I remember reading a while back about NASA's testing procedures and they have a team who's sole job is finding bugs in the code produced by the other development teams. It seems like that structure should be adopted for these security critical projects. Ideally the open source community is supposed to help out with the reviews, but in reality it needs to be someone's whole job.
- a3n 12y agoI think the NSA's clandestine backdooring of hardware, software and standards, in contradiction of their charter, shows that the processes and organizations producing and shipping those protocols, software and hardware also need adversarial testing.
- yuhong 12y agoAlso reminds me of False Start.
- driverdan 12y agoA lot of native clients suppress cert errors by default making them vulnerable to MITM attacks.
- a3n 12y agoYou can't believe it? Why not? The internet was built over a period of generations by different people, and many subsets of them were probably building something completely different from the other subsets. And it's all still running.