lyskomd-qa March 2005

lyskomd-qa@lists.lysator.liu.se

1 participants
13 discussions

[Bug 1111] Bad error message if lyskomd fails to bind the port
by bugzilla-daemon＠cvs.lysator.liu.se 17 Mar '05

17 Mar '05

http://bugzilla.lysator.liu.se/show_bug.cgi?id=1111 ------- Additional Comments From sw_deo1(a)yahoo.com 2005-03-17 11:36 ------- eqw332 ------- You are receiving this mail because: ------- You are the QA contact for the bug, or are watching the QA contact.

1 0

[Bug 133] Cryptography needed
by bugzilla-daemon＠cvs.lysator.liu.se 11 Mar '05

11 Mar '05

http://bugzilla.lysator.liu.se/show_bug.cgi?id=133 ------- Additional Comments From ceder(a)lysator.liu.se 2005-03-11 12:52 ------- (From update of attachment 84) I like this patch better than the previous, but it is still a bit too vague. >+* login-acquired-credentials:: e Login using acquired credentials (124) This should probably be moved to a separate bug, unless you plan to implement it now. If you do implement it now, the specification for start-tls should say that the client can provide a client certificate that can give credentials to log in without a password using the login-acquired-credentials request. >+@example >+ 1 123 @holl{6,server} >+ @t{=1} >+ <CLIENT starts negotiation> >+@end example >+ >+ >+Indicates that the client wants to begin TLS (see RFC 2246) >+negotiation. Returns successfully if the server is willing, after >+which the client immediately begins negotiating. RFC 2222 states that a profile of it must specify several things. Some of them are relevant here as well, and the current documentation is vague. Quoting RFC 2222, with my comments inside []-brackets: 3. A definition of the method by which the authentication protocol exchange is carried out [a TLS negotiation in our case], including how the challenges and responses are encoded [not -- we are using an 8-bit channel], how the server indicates completion or failure of the exchange [TLS alerts? What happens after a failure to negotiate TLS? Can it fail?], how the client aborts an exchange [I don't know if that is applicable to us], and how the exchange method interacts with any line length limits in the protocol [not applicable, as there are no such limits]. 4. Identification of the octet where any negotiated security layer starts to take effect, in both directions. [Immediately after the newline of the start-tls command in the direction from client to server, and immediately after the newline in the response to that command in the other direction, I presume.] >+@subheading Security considerations >+ >+There is a security issue involving man-in-the-middle attack that >+client implementators should be aware of. Someone acting as a MITM can >+interfere with the response to this request, inhibiting the use of TLS >+(causing authentication tokens to be transferred in clear over the >+network). It is recommended that clients warn if servers that have >+previously been willing to perform TLS negotiating are no longer >+willing. >+ >+Another security issue is that while a successful TLS negotiation can >+provide server authentication (through different means, including >+X.509 certificates, OpenPGP keys and SRP), it only guarantees to >+provide a secure channel between the parties involved in the >+negotiation (meaning MITM attacks are possible even when using TLS). insert "unless a server authentication mechanism is used" for clarity. ------- You are receiving this mail because: ------- You are the QA contact for the bug, or are watching the QA contact.

1 0

[Bug 133] Cryptography needed
by bugzilla-daemon＠cvs.lysator.liu.se 11 Mar '05

11 Mar '05

http://bugzilla.lysator.liu.se/show_bug.cgi?id=133 ------- Additional Comments From pont_lysbugzilla(a)soua.net 2005-03-11 12:31 ------- Created an attachment (id=84) --> (http://bugzilla.lysator.liu.se/attachment.cgi?id=84&action=view) Alternate proposed change to Protcol-A.texi Alternate version of protocol changes. ------- You are receiving this mail because: ------- You are the QA contact for the bug, or are watching the QA contact.

1 0

[Bug 133] Cryptography needed
by bugzilla-daemon＠cvs.lysator.liu.se 09 Mar '05

09 Mar '05

http://bugzilla.lysator.liu.se/show_bug.cgi?id=133 pont_lysbugzilla(a)soua.net changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #82 is|0 |1 obsolete| | ------- Additional Comments From pont_lysbugzilla(a)soua.net 2005-03-09 15:38 ------- Created an attachment (id=83) --> (http://bugzilla.lysator.liu.se/attachment.cgi?id=83&action=view) Proposed diff for Protocol-A.texi (fixed examples) Fixed extra spaces and missing @t in examples. ------- You are receiving this mail because: ------- You are the QA contact for the bug, or are watching the QA contact.

1 0

[Bug 133] Cryptography needed
by bugzilla-daemon＠cvs.lysator.liu.se 09 Mar '05

09 Mar '05

http://bugzilla.lysator.liu.se/show_bug.cgi?id=133 ------- Additional Comments From pont_lysbugzilla(a)soua.net 2005-03-09 15:30 ------- Created an attachment (id=82) --> (http://bugzilla.lysator.liu.se/attachment.cgi?id=82&action=view) Proposed diff for Protocol-A.texi If possible, I'd like to address any protocol changes required as soon as possible. I've added a Security implications subheading, mentioning that MITM attack and the fact that TLS doesn't guarantee server authentication. Does anyone else have any objections to the protocol or can we add this to the protocol A definition? ------- You are receiving this mail because: ------- You are the QA contact for the bug, or are watching the QA contact.

1 0

[Bug 133] Cryptography needed
by bugzilla-daemon＠cvs.lysator.liu.se 09 Mar '05

09 Mar '05

http://bugzilla.lysator.liu.se/show_bug.cgi?id=133 ceder(a)lysator.liu.se changed: What |Removed |Added ---------------------------------------------------------------------------- Target Milestone|Future |2.2.0 ------- Additional Comments From ceder(a)lysator.liu.se 2005-03-09 14:41 ------- Many thanks for the implementation. I won't commit it until the blocking is fixed, and I don't have time to work on that in the near future. Rescheduling, as a very large part of the work is now done. Please write a note here if you update your patch. ------- You are receiving this mail because: ------- You are the QA contact for the bug, or are watching the QA contact.

1 0

[Bug 133] Cryptography needed
by bugzilla-daemon＠cvs.lysator.liu.se 09 Mar '05

09 Mar '05

http://bugzilla.lysator.liu.se/show_bug.cgi?id=133 pont_lysbugzilla(a)soua.net changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |pont_lysbugzilla(a)soua.net ------- Additional Comments From pont_lysbugzilla(a)soua.net 2005-03-09 14:34 ------- The block issue can be addressed by writing push and pull functions for gnutls data handling. Hopefully, someone more versed in liboop usage can do this (which shouldn't be difficult). Otherwise, I intend to have a look at it later. ------- You are receiving this mail because: ------- You are the QA contact for the bug, or are watching the QA contact.

1 0

[Bug 133] Cryptography needed
by bugzilla-daemon＠cvs.lysator.liu.se 09 Mar '05

09 Mar '05

http://bugzilla.lysator.liu.se/show_bug.cgi?id=133 ceder(a)lysator.liu.se changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #79 mime|text/plain |application/x-gzip type| | ------- You are receiving this mail because: ------- You are the QA contact for the bug, or are watching the QA contact.

1 0

[Bug 133] Cryptography needed
by bugzilla-daemon＠cvs.lysator.liu.se 09 Mar '05

09 Mar '05

http://bugzilla.lysator.liu.se/show_bug.cgi?id=133 ceder(a)lysator.liu.se changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #79 is|1 |0 patch| | ------- You are receiving this mail because: ------- You are the QA contact for the bug, or are watching the QA contact.

1 0

[Bug 133] Cryptography needed
by bugzilla-daemon＠cvs.lysator.liu.se 09 Mar '05

09 Mar '05

http://bugzilla.lysator.liu.se/show_bug.cgi?id=133 ------- Additional Comments From ceder(a)lysator.liu.se 2005-03-09 11:07 ------- Created an attachment (id=81) --> (http://bugzilla.lysator.liu.se/attachment.cgi?id=81&action=view) Experimental TLS patch for the elisp client Extracted from patch 79 by Pontus Freyhult. ------- You are receiving this mail because: ------- You are the QA contact for the bug, or are watching the QA contact.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

lyskomd-qa March 2005