Re: SKIP: TLS bug in gnu/javax/net/ssl/provider

----- Original Message -----
> Hi,
>=20
> Any progress on this? I=E2=80=99d like to report the plan in our research=
 paper.
>=20

I'll look into this again as soon as I'm finished with the current OpenJDK
security update i.e. in a couple of weeks at most. I plan for an updated
release which fixes this and other recent SSL issues.

I still haven't been able to access the test server you mentioned to me.
I'll try and come up with some other means to test the fix.

> Best,
> Karthik
>=20
> On 06 Mar 2015, at 14:40, Andrew Hughes <[email protected]> wrote:
>=20
> > ----- Original Message -----
> >> Hi,
> >>=20
> >> We=E2=80=99ve been testing TLS implementations for state machine viola=
tions and
> >> found
> >> a number of unexpected behaviours.
> >> See: http://www.smacktls.com
> >> I am writing to report a bug in classpath=E2=80=99s TLS implementation=
 at
> >> gnu/javax/net/ssl/provider
> >>=20
> >> Both the client and server in classpath=E2=80=99s TLS library allow th=
e peer to
> >> skip
> >> the ChangeCipherSpec message, hence disabling encryption.
> >> That is, they will accept a Finished message in the handshake even if =
they
> >> have not received a ChangeCipherSpec message.
> >> The easy fix is to require CCS before finished, *and* to ensure that n=
o
> >> messages are received between CCS and Finished.
> >>=20
> >> The bug allows the peer to downgrade any TLS connection to plaintext.
> >> This is worrying in itself, but also opens up more serious attacks.
> >> For example, see the attacks on Java in
> >> http://http://www.smacktls.com/smack.pdf
> >>=20
> >> I=E2=80=99d be happy to discuss this bug in more details with whoever=
=E2=80=99s working on
> >> that bit of the code.
> >> We have tests and demos and would be happy to help test patches.
> >>=20
> >> Best,
> >> Karthik
> >>=20
> >>=20
> >>=20
> >> _______________________________________________
> >> Bug-classpath mailing list
> >> [email protected]
> >> https://lists.gnu.org/mailman/listinfo/bug-classpath
> >>=20
> >=20
> > Funnily enough, I was just reading the site this morning and realising
> > that we'd patched this in OpenJDK in January.
> >=20
> > I'll take a look at fixing this in the GNU Classpath code and would
> > be interested in any tests/demos you have to help. Is the web server
> > mentioned on smacktls.com still operational?
> >=20
> > Thanks,
> > --
> > Andrew :)
> >=20
> > Free Java Software Engineer
> > Red Hat, Inc. (http://www.redhat.com)
> >=20
> > PGP Key: ed25519/35964222 (hkp://keys.gnupg.net)
> > Fingerprint =3D 5132 579D D154 0ED2 3E04  C5A0 CFDA 0F9B 3596 4222
> >=20
> > PGP Key: rsa4096/248BDC07 (hkp://keys.gnupg.net)
> > Fingerprint =3D EC5A 1F5E C0AD 1D15 8F1F  8F91 3B96 A578 248B DC07
>=20
>=20

--=20
Andrew :)

Free Java Software Engineer
Red Hat, Inc. (http://www.redhat.com)

PGP Key: ed25519/35964222 (hkp://keys.gnupg.net)
Fingerprint =3D 5132 579D D154 0ED2 3E04  C5A0 CFDA 0F9B 3596 4222

PGP Key: rsa4096/248BDC07 (hkp://keys.gnupg.net)
Fingerprint =3D EC5A 1F5E C0AD 1D15 8F1F  8F91 3B96 A578 248B DC07