Re: Freenet 0.7.5 build 1476 is now available

Florent Daigniere <[email protected]> Mon, 06 Mar 2017 10:29:02 +0100

Newsgroups	gmane.network.freenet.devel
Message-ID	<[email protected]>

On Sun, 2017-03-05 at 20:59 -0600, Pascal wrote:
> Yes, thank you, I was able to confirm that RSA is DOA in 1476.  1475
> and before only supported RSA so 1476 broke SSL for everyone, though I
> doubt many people use it.
> 

You are the first one to complain about it.

> The bigger issue is why 1476 built at all.  It has been a long time 
> since I did any development for Freenet.  Are there not unit tests
> for the SSL libraries?  I wonder what that says about Fred's code
> coverage in general.
> 

No, there aren't any unit tests for that specific feature (that is non-
default and very few people use).

> Is someone trying to reinvent the wheel here?  It looks like 1476
> only supports TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256.  I can't
> imagine there is not a SSL library that can be integrated with Fred
> that implements all the common standards including detecting client
> support for them.
> 

IIRC we use a subset of whatever the JCE supports... and our subset
happens to be narrower with 1476. Put it back into context: it was
changed because the previous cipher-set was using DHE and that it is
impossible to do right in java (can't change the group).

> I agree with Florent "that we should switch to what others are doing 
> cipher-wise", and half the ciphers at the provided link are RSA.  What
> I don't understand is why the provided link did not go to the
> Intermediate (default) security model.  When something is the default
> that is typically what others are doing.
> 

With freenet we always aim at doing "better". In this instance, there is
a very good reason why the Intermediate profile is something we
shouldn't use: it allows for DH-based ciphers.

Should we have implemented the Secure profile instead? Probably! You're
welcome to send a patch.

Florent

_______________________________________________
Devl mailing list
[email protected]
https://emu.freenetproject.org/cgi-bin/mailman/listinfo/devl

signature.asc (application/pgp-signature, 488 B)