mainSavannah Administration - Support: sr #107417, TLS Renegotiation Indication...

 
 

sr #107417: TLS Renegotiation Indication Extension (proposed standard RFC 5746) support

Submitter:  Matt McCutchen <hashproduct>
Submitted:  Sat 03 Jul 2010 07:20:39 PM UTC
Votes: 10
 
Category:  None Priority:  5 - Normal
Severity:  2 - Minor Status:  Done
Privacy:  Public Assigned to:  None
Operating System:  None Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Fri 07 Jan 2011 07:04:40 PM UTC, comment #7: 

OK, thanks for the input.

Sylvain Beucler <Beuc>
Fri 07 Jan 2011 06:00:29 PM UTC, comment #6: 

Debian has just released openssl 0.9.8g-15+lenny10 with renegotiation indication support, and Savannah appears to have picked it up, so the problem is solved.

https://savannah.gnu.org still does not get the blue badge in Mozilla with "security.ssl.treat_unsafe_negotiation_as_broken = true" due to embedded content from https://static.fsf.org, which does not support renegotiation indication.  I have emailed -email is unavailable- about it.

Matt McCutchen <hashproduct>
Sun 04 Jul 2010 01:38:47 AM UTC, comment #5: 


> Mixing "RFC" and "standard" is a confusion I don't want to spread.

I did not intend to do any such thing.  I was only challenging your argument in comment #1.  My point is that the technology is mature and addresses a pressing need, therefore it should be deployed.  "RFC 5746" is simply the most convenient way I have to refer to the technology; I don't care about the IETF status of that document.

Matt McCutchen <hashproduct>
Sat 03 Jul 2010 11:18:16 PM UTC, comment #4: 

Btw thanks for reporting this :)

Sylvain Beucler <Beuc>
Sat 03 Jul 2010 11:01:01 PM UTC, comment #3: 

Mixing "RFC" and "standard" is a confusion I don't want to spread.
Your other arguments are more interesting.

Installing packages from Debian "testing" on "stable" sounds like a work-around that will break in the long run; if supporting this basically requires upgrading openssl, we probably need a maintained backport (cf. backports.org).

Sylvain Beucler <Beuc>
Sat 03 Jul 2010 10:14:00 PM UTC, comment #2: 


> Note that this is just a proposed standard so we SHOULD not support it yet ;)


Where did you get the idea that proposed standards should not be deployed?  RFC 5746 is supported by all of the major free SSL implementations (NSS, OpenSSL, gnutls) and by many popular web sites including Mozilla, Google, and Red Hat.  In all likelihood, it is not going to change incompatibly.

> I'd appreciated pointers on how to do that in Debian Lenny.


For my own web server, which is running Debian etch, I installed {openssl,libssl0.9.8}-0.9.8o-1 from squeeze.  It has worked without incident since May 2.

Matt McCutchen <hashproduct>
Sat 03 Jul 2010 07:34:46 PM UTC, comment #1: 

Note that this is just a proposed standard so we SHOULD not support it yet ;)
When/if it becomes standard, I'd appreciated pointers on how to do that in Debian Lenny.

Sylvain Beucler <Beuc>
Sat 03 Jul 2010 07:20:39 PM UTC, original submission:  

The Web servers should support RFC 5746 (http://tools.ietf.org/html/rfc5746) to advertise that they are not vulnerable to the SSL renegotiation attack.  In the future, this will be required for them to receive the blue SSL badge in Mozilla-derived browsers (see https://bugzilla.mozilla.org/show_bug.cgi?id=535649).

Matt McCutchen <hashproduct>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by Beuc (Posted a comment)
  • -email is unavailable- added by hashproduct (Voted in favor of this item)
  • -email is unavailable- added by hashproduct (Submitted the item)
  •  

    There are 10 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2011-01-07 Beuc Open/ClosedOpen Closed
        StatusNone Done
    2010-07-03 Beuc SummaryRFC 5746 support TLS Renegotiation Indication Extension (proposed standard RFC 5746) support
    2010-07-03 hashproduct Carbon-Copy- Added hashproduct

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code