From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Jens Lechtenboerger Newsgroups: gmane.emacs.bugs Subject: bug#16978: 24.3; SSL/TLS with multiple man-in-the-middle vulnerabilities Date: Tue, 18 Mar 2014 22:04:08 +0100 Organization: Privat Message-ID: <86y5078bhz.fsf@informationelle-selbstbestimmung-im-internet.de> References: <86siqqv938.fsf@informationelle-selbstbestimmung-im-internet.de> <878us88ri7.fsf@lifelogs.com> NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Trace: ger.gmane.org 1395177369 18809 80.91.229.3 (18 Mar 2014 21:16:09 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Tue, 18 Mar 2014 21:16:09 +0000 (UTC) To: 16978@debbugs.gnu.org Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Tue Mar 18 22:16:19 2014 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1WQ1Mv-0000as-Qy for geb-bug-gnu-emacs@m.gmane.org; Tue, 18 Mar 2014 22:16:18 +0100 Original-Received: from localhost ([::1]:37469 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WQ1Mv-0003qa-9L for geb-bug-gnu-emacs@m.gmane.org; Tue, 18 Mar 2014 17:16:17 -0400 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:58571) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WQ1Mm-0003jZ-Sy for bug-gnu-emacs@gnu.org; Tue, 18 Mar 2014 17:16:14 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WQ1Mh-00033n-65 for bug-gnu-emacs@gnu.org; Tue, 18 Mar 2014 17:16:08 -0400 Original-Received: from debbugs.gnu.org ([140.186.70.43]:39256) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WQ1Mh-00033j-3Q for bug-gnu-emacs@gnu.org; Tue, 18 Mar 2014 17:16:03 -0400 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.80) (envelope-from ) id 1WQ1Mg-000556-EW for bug-gnu-emacs@gnu.org; Tue, 18 Mar 2014 17:16:02 -0400 X-Loop: help-debbugs@gnu.org In-Reply-To: <86siqqv938.fsf@informationelle-selbstbestimmung-im-internet.de> Resent-From: Jens Lechtenboerger Original-Sender: "Debbugs-submit" Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Tue, 18 Mar 2014 21:16:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 16978 X-GNU-PR-Package: emacs X-GNU-PR-Keywords: security X-Debbugs-Original-To: bug-gnu-emacs@gnu.org Original-Received: via spool by submit@debbugs.gnu.org id=B.139517732719472 (code B ref -1); Tue, 18 Mar 2014 21:16:02 +0000 Original-Received: (at submit) by debbugs.gnu.org; 18 Mar 2014 21:15:27 +0000 Original-Received: from localhost ([127.0.0.1]:40438 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.80) (envelope-from ) id 1WQ1M5-00053u-Ld for submit@debbugs.gnu.org; Tue, 18 Mar 2014 17:15:26 -0400 Original-Received: from eggs.gnu.org ([208.118.235.92]:56731) by debbugs.gnu.org with esmtp (Exim 4.80) (envelope-from ) id 1WQ1M2-00053h-OB for submit@debbugs.gnu.org; Tue, 18 Mar 2014 17:15:23 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WQ1Lw-0002sa-PO for submit@debbugs.gnu.org; Tue, 18 Mar 2014 17:15:22 -0400 Original-Received: from lists.gnu.org ([2001:4830:134:3::11]:35560) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WQ1Lw-0002sW-Ms for submit@debbugs.gnu.org; Tue, 18 Mar 2014 17:15:16 -0400 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:58443) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WQ1Lr-0002Gw-DJ for bug-gnu-emacs@gnu.org; Tue, 18 Mar 2014 17:15:16 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WQ1Lm-0002nV-4v for bug-gnu-emacs@gnu.org; Tue, 18 Mar 2014 17:15:11 -0400 Original-Received: from plane.gmane.org ([80.91.229.3]:55076) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WQ1Ll-0002kD-Tl for bug-gnu-emacs@gnu.org; Tue, 18 Mar 2014 17:15:06 -0400 Original-Received: from list by plane.gmane.org with local (Exim 4.69) (envelope-from ) id 1WQ1Lk-00076g-3X for bug-gnu-emacs@gnu.org; Tue, 18 Mar 2014 22:15:04 +0100 Original-Received: from mnsr-4db0a223.pool.mediaways.net ([77.176.162.35]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Tue, 18 Mar 2014 22:15:04 +0100 Original-Received: from jens.lechtenboerger by mnsr-4db0a223.pool.mediaways.net with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Tue, 18 Mar 2014 22:15:04 +0100 X-Injected-Via-Gmane: http://gmane.org/ Mail-Followup-To: bug-gnu-emacs@gnu.org Original-Lines: 63 Original-X-Complaints-To: usenet@ger.gmane.org X-Gmane-NNTP-Posting-Host: mnsr-4db0a223.pool.mediaways.net Mail-Copies-To: never OpenPGP: id=0xA142FD84; url=http://www.informationelle-selbstbestimmung-im-internet.de/A142FD84.asc User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.3.50 (gnu/linux) Cancel-Lock: sha1:bIjn9EUy4F65L6FVm98oCOTMlJI= X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-detected-operating-system: by eggs.gnu.org: Error: Malformed IPv6 address (bad octet value). X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.15 Precedence: list X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 140.186.70.43 X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Original-Sender: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.bugs:86942 Archived-At: On 2014-03-17, Ted Zlatanov wrote: > On Mon, 10 Mar 2014 07:52:43 +0100 Jens Lechtenboerger > wrote: > > JL> gnutls-cli --tofu opens a TLS connection and asks whether the > JL> certificate can be trusted. > JL> [...] > JL> to prevent the process from hanging while waiting for the > JL> user's reply, option --strict-tofu (introduced in GnuTLS > JL> 3.2.12) can be used. > > That's wonderful, but please realize this doesn't work for Emacs because > often, interactive prompting would not be available. The consensus so > far has been to abort the connection and tell the user how to allow a > host specifically. Hi Ted, are you outlining plans for the future? According to what I observed so far, I’m either vulnerable to MITM attacks or I cannot use servers with self-signed certificates. I see three partially contradictory requirements here: 1. No interactive prompting. 2. Allow self-signed certificates. 3. Protect against MITM attacks (at least those involving self-signed forged certs; better yet, also with “trusted” forged certs). Among those three, at most two can be guaranteed simultaneously. >From http://debbugs.gnu.org/13374 I got the impression that (2) is a must. (I rely on self-signed certs as well.) In addition, in my view (3) is a must. Others may disagree and choose the convenience of (1) over the security of (3). If Emacs defaults to (1) over (3) based on a deliberate decision, that decision needs to be documented prominently. Coming back to your comment, I believe that --strict-tofu satisfies precisely what you describe: It aborts the connection, and you can add the new certificate with --tofu. > Can you suggest a cleaner way, perhaps using TOFU > with some C automation? I’m not really sure what you are looking for. > (`gnutls-cli' should not be assumed to be available) Sadly, that’s true. But it could (a) be recommended and (b) be used if it is available (and (c) be used in a safer way). > I appreciate all your review. It's too late to make these changes for > 24.4, but I think if you can review the state of things in 24.4, maybe > we could discuss an expedited 24.5 release with security fixes (that > would be up to the Emacs maintainers, of course). I’ll certainly work with 24.4. Just let me know what kind of input you need then. Best wishes Jens