GnuTLS servers are able to use tickets issued by each other without access to the secret key as generated by gnutls_session_ticket_key_generate()
. This allows a MITM server without valid credentials to resume sessions with a client that first established an initial connection with a server with valid credentials. The issue applies to TLS 1.3, when using TLS 1.2 resumption fails as expected.
Because the ticket can be used for resumption without knowledge of the master key I assume (but haven't tested yet) that it can also be used for passive decryption of early data.
I first noticed the issue with Ubuntu version 3.6.13-2ubuntu1, and reproduced it with a build from master
as of52e78f1e.
Steps to Reproduce
gnutls-serv --x509keyfile=authority/server/secret.key --x509certfile=authority/server/x509.pem openssl s_client -connect localhost:5556 -CAfile authority/x509.pem -verify_return_error -sess_out session.cache gnutls-serv --x509keyfile=rogueca/mitm/secret.key --x509certfile=rogueca/mitm/x509.pem openssl s_client -connect localhost:5556 -CAfile authority/x509.pem -verify_return_error -sess_in session.cache
I've used openssl s_client
to reproduce the problem because gnutls-cli
lacks a way to store resumption data across invocations, but the effect is also reproducible with applications using GnuTLS that cache session data long enough to change the server. I noticed the issue while implementing session resumption for proxy connections in mod_gnutls.
The certificates are just ones out of my test PKI, I can post them if it helps. What matters is that the server from step 1 has a certificate issued by a CA the client trusts, while the server from step 4 has one issued by a CA unknown to the client.
Actual results
The bogus server is able to resume the session, the client does not detect the attack.
Expected results
Session resumption should fail, leading to a full handshake, which must fail unless the second server has valid credentials. A successful full handshake would be the expected result if the server would be restarted with the same certificate instead of a bogus one.
GnuTLS servers are able to use tickets issued by each other without access to the secret key as generated by gnutls_session_ticket_key_generate()
. This allows a MITM server without valid credentials to resume sessions with a client that first established an initial connection with a server with valid credentials. The issue applies to TLS 1.3, when using TLS 1.2 resumption fails as expected.
Because the ticket can be used for resumption without knowledge of the master key I assume (but haven't tested yet) that it can also be used for passive decryption of early data.
I first noticed the issue with Ubuntu version 3.6.13-2ubuntu1, and reproduced it with a build from master
as of 52e78f1e3a95a6d9e4f1f9a72f6d77102e80f196.
Steps to Reproduce
gnutls-serv --x509keyfile=authority/server/secret.key --x509certfile=authority/server/x509.pem openssl s_client -connect localhost:5556 -CAfile authority/x509.pem -verify_return_error -sess_out session.cache gnutls-serv --x509keyfile=rogueca/mitm/secret.key --x509certfile=rogueca/mitm/x509.pem openssl s_client -connect localhost:5556 -CAfile authority/x509.pem -verify_return_error -sess_in session.cache
I've used openssl s_client
to reproduce the problem because gnutls-cli
lacks a way to store resumption data across invocations, but the effect is also reproducible with applications using GnuTLS that cache session data long enough to change the server. I noticed the issue while implementing session resumption for proxy connections in mod_gnutls.
The certificates are just ones out of my test PKI, I can post them if it helps. What matters is that the server from step 1 has a certificate issued by a CA the client trusts, while the server from step 4 has one issued by a CA unknown to the client.
Actual results
The bogus server is able to resume the session, the client does not detect the attack.
Expected results
Session resumption should fail, leading to a full handshake, which must fail unless the second server has valid credentials. A successful full handshake would be the expected result if the server would be restarted with the same certificate instead of a bogus one.
以上就是本文的全部内容，希望本文的内容对大家的学习或者工作能带来一定的帮助，也希望大家多多支持 码农网
猜你喜欢:
本站部分资源来源于网络，本站转载出于传递更多信息之目的，版权归原作者或者来源机构所有，如转载稿涉及版权问题，请联系我们。
趣学Python编程
Jason Briggs / 尹哲 / 人民邮电出版社 / 2014-3 / 45.00元
python是一款解释型、面向对象、动态数据类型的高级程序设计语言。python语法简捷而清晰，具有丰富和强大的类库，因而在各种行业中得到广泛的应用。对于初学者来讲，python是一款既容易学又相当有用的编程语言，国内外很多大学开设这款语言课程，将python作为一门编程语言学习。 《趣学python编程》是一本轻松、快速掌握python编程的入门读物。全书分为3部分，共18章。第1部分是第......一起来看看 《趣学Python编程》 这本书的介绍吧!
