[gambit-list] No TLS certificate validation

Adam adam.mlmb at gmail.com
Wed Nov 15 20:43:17 EST 2017


Sure, working up Gambit's built-in OpenSSL API integration to work as a
client for ordinary usecases, works.

The outcome will be something like ~5,000-10,000 lines of integration code,
that requires some degree of continuous maintenance. For comparison,
LibCurl's integration is in the range 3600 - 7000 lines, https://github.com/
curl/curl/blob/master/lib/vtls/openssl.c https://github.
com/curl/curl/blob/master/lib/vtls/vtls.c https://github.
com/curl/curl/blob/master/lib/vtls/schannel.c .


Please remember that SSL domain validation only is the tip of the iceberg
though, in such a way that in particular for server usecases and also for
more sophisticated client usecases, OpenSSL's unending quirks (and very low
code quality) lead you to need an application-level solution anyhow.

(
I suggest SSL domain name validation is only the tip of the iceberg, you'll
want to
 * negotiate the right ciphers with the right settings,
 * configure exact TLS/SSL versions supported,
 * cap TSL renegotiation ability,
 * in server mode deliver more TLS certificates on the same TLS server (IP),
 * read certificates from binary blobs and generate local certificates,
 * and then finally someone will like to do a non-TSL handshake/warmup
before the TLS takes over, or do TLS over something else than a TCP port.
)


On my TODO is to implement a proof of concept application layer ports for
Gambit. After reading _io.scm a couple of times and talking to Vyzo about
it, I was struck with a sense of confidence that I could actually do it heh.



2017-11-16 1:09 GMT+08:00 Dimitris Vyzovitis <vyzo at hackzen.org>:

> Seems that it's a matter of using SSL_CTX_set_verify on the tls context,
> with SSL_VERIFY_PEER.
> See https://wiki.openssl.org/index.php/Manual:SSL_CTX_set_verify(3)
>
> -- vyzo
>
> On Wed, Nov 15, 2017 at 2:33 PM, Marc Feeley <feeley at iro.umontreal.ca>
> wrote:
>
>> Clearly something has to be done! I didn’t write that code, so perhaps
>> someone with more experience with OpenSSL should take a look at it.
>>
>> Marc
>>
>>
>>
>> > On Nov 15, 2017, at 4:17 AM, Dimitris Vyzovitis <vyzo at hackzen.org>
>> wrote:
>> >
>> > Marc,
>> >
>> > It seems that the TLS stack is completely lacking client-side server
>> > certificate validation. There are now two open issues on github (#200
>> > and #312 which I just opened).
>> >
>> > This is a real security problem, as not having certificate validation
>> > defeats the whole purpose of TLS.
>> >
>> > Can we do something about it?
>> >
>> > -- vyzo
>> >
>>
>>
>
> _______________________________________________
> Gambit-list mailing list
> Gambit-list at iro.umontreal.ca
> https://webmail.iro.umontreal.ca/mailman/listinfo/gambit-list
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.iro.umontreal.ca/pipermail/gambit-list/attachments/20171116/53d292bd/attachment.htm>


More information about the Gambit-list mailing list