Re: Missing TLS features in OCamlnet 4.x

--===============8923006993316078433==
Content-Type: multipart/signed; micalg="pgp-sha1";
	protocol="application/pgp-signature"; 
	boundary="=-4xPGzaPkeqgUDTMl4D7W"


--=-4xPGzaPkeqgUDTMl4D7W
Content-Type: text/plain; charset="ISO-8859-15"
Content-Transfer-Encoding: quoted-printable

Hi Thomas,

Am Mittwoch, den 06.05.2015, 16:31 +0200 schrieb Thomas Calderon:
> Hi,
>=20
>=20
> I have started working towards supporting OCamlnet 4.x in our project.
>=20
>=20
> I had to completely rewrite the TLS code, this was expected due to
> OCamlnet switching to GnuTLS.
>=20
>=20
> I have noticed the following issues with the current TLS code:
>   * dh_params is not used in the code therefore DHE-* suites are not
> enabled
>     - Using the *gnutls_certificate_set_dh_params* solves the issue
> (see attachment for example)

Well spotted. I have some concerns about the side effect, though. There
is no function to copy a certificate.

>   * support for elliptic curve key exchange seems disabled (ECDHE-*
> suites), I have not tried an ECC certificate.
>   * support for GCM algorithms is not enabled

I'm quite sure that I saw ECDHE and GCM in tests. I'll retest tomorrow.

It is possible to de-configure these features in GnuTLS.

>   * sample TLS netplex configuration is missing some ";" for each
> sections
>=20
>=20
> Do you have the same behavior? It might be linked to my GnuTLS
> version.
> Did you manage to enable higher-end ciphersuites and PFS suites?

Gerd

>=20
> Thanks for the feedback.
>=20
>=20
> Thomas.
>=20
>=20
>=20
>=20
> -------------------------------------------------------------------------=
-----
> One dashboard for servers and applications across Physical-Virtual-Cloud=
=20
> Widest out-of-the-box monitoring support with 50+ applications
> Performance metrics, stats and reports that give you Actionable Insights
> Deep dive visibility with transaction tracing using APM Insight.
> http://ad.doubleclick.net/ddm/clk/290420510;117567292;y
> _______________________________________________
> Ocamlnet-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/ocamlnet-devel

--=20
------------------------------------------------------------
Gerd Stolpmann, Darmstadt, Germany    [email protected]
My OCaml site:          http://www.camlcity.org
Contact details:        http://www.camlcity.org/contact.html
Company homepage:       http://www.gerd-stolpmann.de
------------------------------------------------------------


--=-4xPGzaPkeqgUDTMl4D7W
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAABAgAGBQJVSn7RAAoJEAaM4b9ZLB5TvMYH/AzUm/Dqle/Xyr5Y1Wjh/qbk
58Bmid24hXPbx9eU7TrDnz/VD5BHmA2utid3hR+rt8Mmbsxlm4yjv7Td1OX/Nuhw
t2Q73yyEtjUVkuVkVGTx3FCkZCAHqxYQNmj2ei2CmqpUhJDiUgbhN1rvcW8iIdoW
iIEBeoswDfhsP+ypx6vT45pW4MLy3ok0eU9o3yjM8L0yJD+bwYpI8NOLkQPcjvmT
N8K7osC7/pPCiINpiQ33D4iQ5Tm6kONR5kf+oYhOkDjQffsoS1K7R36Ov2b3jutS
sqWBGpMKWWqlP8C6IA1KUfRH4a7LhzIv4cuNOdqxGv3CmU4KNTWHXuQlkGRk/TQ=
=RMwc
-----END PGP SIGNATURE-----

--=-4xPGzaPkeqgUDTMl4D7W--



--===============8923006993316078433==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

------------------------------------------------------------------------------
One dashboard for servers and applications across Physical-Virtual-Cloud 
Widest out-of-the-box monitoring support with 50+ applications
Performance metrics, stats and reports that give you Actionable Insights
Deep dive visibility with transaction tracing using APM Insight.
http://ad.doubleclick.net/ddm/clk/290420510;117567292;y
--===============8923006993316078433==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Ocamlnet-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ocamlnet-devel

--===============8923006993316078433==--