From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Lars Magne Ingebrigtsen Newsgroups: gmane.emacs.devel Subject: Re: [PATCH RFC] GnuTLS: Support TOFU certificate checking. Date: Wed, 08 Oct 2014 15:25:43 +0200 Message-ID: References: <1412716565-7786-1-git-send-email-toke@toke.dk> <87a957o87z.fsf@alrua-karlstad.karlstad.toke.dk> <87bnpm2249.fsf@toke.dk> <83eguik9ip.fsf@gnu.org> <83d2a2k91n.fsf@gnu.org> <83bnpmk8fd.fsf@gnu.org> NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain X-Trace: ger.gmane.org 1412774815 10425 80.91.229.3 (8 Oct 2014 13:26:55 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Wed, 8 Oct 2014 13:26:55 +0000 (UTC) Cc: tzz@lifelogs.com, toke@toke.dk, emacs-devel@gnu.org To: Eli Zaretskii Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Wed Oct 08 15:26:46 2014 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1XbrGN-0003oi-NZ for ged-emacs-devel@m.gmane.org; Wed, 08 Oct 2014 15:26:43 +0200 Original-Received: from localhost ([::1]:36229 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XbrGN-0007uF-Ba for ged-emacs-devel@m.gmane.org; Wed, 08 Oct 2014 09:26:43 -0400 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:56252) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XbrFt-0007l8-RZ for emacs-devel@gnu.org; Wed, 08 Oct 2014 09:26:19 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XbrFo-0005eV-Au for emacs-devel@gnu.org; Wed, 08 Oct 2014 09:26:13 -0400 Original-Received: from hermes.netfonds.no ([80.91.224.195]:48257) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XbrFo-0005e5-55; Wed, 08 Oct 2014 09:26:08 -0400 Original-Received: from cm-84.215.51.58.getinternet.no ([84.215.51.58] helo=stories.gnus.org) by hermes.netfonds.no with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16) (Exim 4.72) (envelope-from ) id 1XbrFQ-0002Kj-ON; Wed, 08 Oct 2014 15:25:44 +0200 Face: iVBORw0KGgoAAAANSUhEUgAAADAAAAAwBAMAAAClLOS0AAAAD1BMVEVKUlSux88mJiWZs7pu f4QxwGGwAAACT0lEQVQ4jW2UgY3kIAxFvUAByzkFIEIBEFOAA+6/pvuQzJ5OWqTdmcnDxv/bhOxd 8v+qJMLxl3WQtPcrtkXp8g989nT10TT8gIaIbjajJh81l/XDrDGtTJUIDyf+3B07EYUHsMshsApA iZwA9AG1SA/iJEQNdvnIsQKsgFuO0E82VqKEndJbBDhKtOnH5DlyRgWRTTdg5PY9ifQcVk6kofsD zpHIRlA1R42DxQ/oOWdKPHJYAOl+gGmZ4SgQU9vxggOFN5TGYUipvrfr6wUO4LuIUBk+xSopPuCC BXEQTUQOeHX5BzAkNcbhqwDUNrPZvcDlGa3AgzHXJ7m0ZABoO+AzkeGBas6wZX6Ay8Vlh0QV/3TG 42sDsWAz6G4cW6gAO8KuMCM0RIn4zRPSH4AqwoSGp9VWc2jfO1VNMM6jp6sR3+qmNoevBAXB5ZNs R/xJQayfSyBEdC+YgD1fx4QghylZlqzqrkQBSJHzVbiB5yzQCPFL0GrNzQ+4zuU99UQTmjDSt2ww 81Kf/fAKsxaYG/BVpnnRnm4VR3BOXwCjycscOlVCh4v0gGufR730adcpmXKWBSRJEyA3AfK8itWy wWolhjOo9IkPxDqcT8LLGV7VknqkdBm2bLBvAjlIhugJf2SDJvsmwAZsLrqNeyJEcSmfrDgjWMA0 wdgN5EIZsnYrGfK9ADucrHbL8K7gjuTzAXDpXOcbemmS6oQ8AEaE7SZhDDCjvo5zg7bmcL0euOaU M+7pCgCILPy8V1ZlWMO/IL7vm109lr1vn8jy26p/AXpElUoFje1TAAAAAElFTkSuQmCC X-Now-Playing: Various's _The Wire Tapper 29_: "Juxtavoices - Guardian Weekend Remix (excerpt)" X-Hashcash: 1:23:141008:tzz@lifelogs.com::WDwYybkJxsG1hl1n:06Uc6 X-Hashcash: 1:23:141008:eliz@gnu.org::d1Sf0SAXSkYy4SRt:00000DrkR X-Hashcash: 1:23:141008:emacs-devel@gnu.org::QFrchVlUoBUKNonT:0000000000000000000000000000000000000000014Ky/ X-Hashcash: 1:23:141008:toke@toke.dk::d1jatzGOSCTKkafG:00001NSN/ In-Reply-To: <83bnpmk8fd.fsf@gnu.org> (Eli Zaretskii's message of "Wed, 08 Oct 2014 16:17:10 +0300") User-Agent: Gnus/5.130012 (Ma Gnus v0.12) Emacs/24.4.50 (gnu/linux) X-MailScanner-ID: 1XbrFQ-0002Kj-ON MailScanner-NULL-Check: 1413379546.09872@kIFK07nlaVRNOgaFaAe8bQ X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 80.91.224.195 X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Original-Sender: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.devel:175126 Archived-At: Eli Zaretskii writes: > So you want to return a descriptor for a connection that failed > certificate validation, and let the application handle that? The other option is to have the C layer close the connection, signal an error, have `open-network-stream' query the user about the invalid certificate, the user says "connect anyway", and then we'd reconnect with other options. That seems less ... convenient. > That could work, but I don't know what security-wary people here will > tell about keeping such connections. I think I know. >"? But there should be no further security implications, really. If you're using `open-network-stream'. If you're using the low-level C functions yourself, you have to respond to the invalid certificate yourself, but why would you? We're just moving the certificate handling up to the Lisp level -- nothing more. -- (domestic pets only, the antidote for overdose, milk.) bloggy blog: http://lars.ingebrigtsen.no