Re: ZEO SSL support and Daft docs

On Wed, Jun 22, 2016 at 3:30 PM, Vincent Pelletier <[email protected]>
wrote:

> On Wed, 22 Jun 2016 17:07:00 -0400, Jim Fulton <[email protected]>
> wrote:
> > On Wed, Jun 22, 2016 at 4:43 PM, Patrick Strawderman <[email protected]>
> wrote:
> > > and cipher
> > > suites?
> >
> > I have no idea. Whatever you get by default in a SSLContext. :)
>
> +1 for default SSL library ciphers suites.
> At least with OpenSSL (and this is likely true for LibreSSL too) it
> reacts to an environment variable to tell which to disable, which to
> prefer, ... But I don't know if it is good practice to depend on this.
>

Looking at the defaults for SSLContext, I think they are probably good
enough, especially if the context is constructed via
SSLContext.create_default_context() (See the defaults
<https://github.com/python/cpython/blob/master/Lib/ssl.py#L184>). Fewer
security-related knobs means fewer ways to shoot yourself in the foot. If
people needed finer grained control, maybe provide a way to override how
the SSLContext is constructed (and default to
SSLContext.create_default_context())? Not suggesting that such an option be
added now, but it would avoid having to add ZEO configuration options
around every single SSL option.


> > > I would suggest not supporting SSL at all, and only supporting TLS.
> > > It seems like ssl.create_default_context() disables SSLv2 and SSLv3,
> as well
> > > as some weak ciphers, but it might make sense to provide a stricter
> default
> > > for the ciphersuite list, and to disable compression (to mitigate
> attacks
> > > like CRIME).  Note that Python >= 2.7.9 and Python >= 3.4 is a
> requirement
> > > for a lot of these options in the ssl module.
> >
> > This sounds reasonable. I'll look into this.
>
> I would go further than only disabling "SSL" (ie, <SSL 4.0): disable
> <TLS 1.2 (ie, <SSL 4.2) by default (hence enabling 1.2 and any future
> evolution), as there is no need for any backward compatibility right
> now.
>

+1
I was going to advocate only supporting TLS 1.2 as well, but didn't have
time to think about the implications. I believe it means OpenSSL >= 1.0.1
would be a requirement (which was released 4 years ago). Note that it seems
like OS X (10.11.5) still ships with OpenSSL 0.9.8 :-(. Anyway, TLS 1.2 is
definitely attractive, because of ECC, perfect forward secrecy, etc.


> I think CRIME does not apply here, but I think it shouldn't hurt to
> disable SSL-level compression.
>

I agree, but I'd say err on the side of caution. I think the weaknesses
that allowed for CRIME apply more broadly, but would definitely be more
difficult to exploit in a non-browser context. Note that
SSLContext.create_default_context() disables compression. Also, storage
implementations such as zc.zlibstorage are already compressing records, so
protocol level compression would mostly be redundant in that case.

-- 
You received this message because you are subscribed to the Google Groups "zodb" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
For more options, visit https://groups.google.com/d/optout.