"The Sorry State of SSL" Hynek Schlawack, PyConRu 2014

THE SORRY STATE OF ССЛ

Hynek Schlawack

@hynek https://hynek.me

https://github.com/hynek

Привет!

https://www.variomedia.de

ONLY LINK

ox.cx/t

WTF

WTFSSL

WTFSSL

& TLS

TIMELINE

TIMELINE1995: Secure Sockets Layer 2.0, Netscape


1996: SSL 3.0, still Netscape



1999: Transport Layer Security 1.0, IETF




2006: TLS 1.1




2006: TLS 1.1

2008: TLS 1.2

2013

2013• newfound scrutiny


• browsers add TLS 1.2


• browsers add TLS 1.2

• just using TLS not enough

TLS

TLS• identity

TLS• identity

• confidentiality

TLS• identity

• confidentiality

• integrity

TLS HYGIENE

SERVERS

BE UP-TO-DATE

• OpenSSL >= 1.0.1c

• Apache >= 2.4.0

• nginx >= 1.0.6 or 1.1.0

BE UP-TO-DATE

• OpenSSL >= 1.0.1c

• Apache >= 2.4.0

• nginx >= 1.0.6 or 1.1.0

g

CERTIFICATES

• identity• validity

CERTIFICATES

• identity• validity• CA sig

CERTIFICATES


CERTIFICATES


CERTIFICATES


CERTIFICATES


EXTENDED VALIDATION CERTIFICATES

EXTENDED VALIDATION CERTIFICATES

TRUST CHAIN

TRUST CHAIN

TRUST CHAIN

CERTIFICATES

• trust chain

CERTIFICATES

• trust chain

• host name/service

CERTIFICATES

• trust chain

• host name/service

• already/still valid?

DISABLE

• SSL 2.0

DISABLE

• SSL 2.0

• SSL 3.0 (if you can)

DISABLE

• SSL 2.0

• SSL 3.0 (if you can)

• TLS compression

CIPHER SUITES

CIPHER

CIPHER

Cipher

CIPHER

CipherPlaintext

CIPHER

CipherPlaintext

CIPHER

Cipher CiphertextPlaintext

Ciphertext

CIPHER

Cipher Plaintext

CIPHER: MODE

CIPHER: MODE

• CBC

CIPHER: MODE

• CBC

• stream ciphers

CIPHER: MODE

• CBC

• stream ciphers

• GCM

ENCRYPTION: PREFER THIS


AES128-GCM&


AES128-GCM&

ChaCha20

ENCRYPTION: FALL BACK TO

AES128-CBC

ENCRYPTION: IF LIFE IS CRUEL TO YOU

3DES-CBC

ENCRYPTION: EOL

ENCRYPTION: DANGEROUS

• EXP-*


• EXP-*

• DES


• EXP-*

• DES

• RC4


• EXP-*

• DES

• RC4

KEY EXCHANGE

KEY EXCHANGEfast PFS

RSA ✔️ ❌


RSA ✔️ ❌

DHE ❌ ✔️


RSA ✔️ ❌

DHE ❌ ✔️

ECDHE ✔️ ✔️


RSA ✔️ ❌

DHE ❌ ✔️

ECDHE ✔️ ✔️

INTEGRITY: MACS

• Message Authentication Code

INTEGRITY: MACS


• HMAC

INTEGRITY: MACS


• HMAC

• GCM

HAVE THE LAST WORD

YOU’RE DONE!

YOU’RE DONE!

(but test your results!)

CERTIFICATE

CERTIFICATE

CERTIFICATE

CERTIFICATE

CERTIFICATE

CERTIFICATE

CERTIFICATE

PROTOCOLS

PROTOCOLS

PROTOCOLS

PROTOCOLS

CIPHER SUITES

CIPHER SUITES

CIPHER SUITES

CIPHER SUITES

CIPHER SUITES

CIPHER SUITES

CIPHER SUITES

CIPHER SUITES

CLIENTS

YOU HAD ONE JOB!

YOU HAD ONE JOB!

VERIFY!

VERIFY THE CERTIFICATE!

• valid?


• valid?

• trustworthy chain?


• valid?

• trustworthy chain?

• correct hostname/service?

TRUST CHAIN

TRUST CHAIN• VERIFY_PEER


• trust stores OS dependent


• trust stores OS dependent

• SSL_CTX_set_default_verify_paths

SYSTEM CA• FreeBSD: ca_root_nss


• debian/Red Hat: ca-certificates



• OS X: TEA or homebrew




• Windows: wincertstore




• Windows: wincertstore

• or: Mozilla/certifi

HOSTNAME VERIFICATION

OpenSSL to developers:


OpenSSL to developers:

LOL

DON’T VERIFY TRUST CHAIN

I can pretend to be Google with any self-signed

certificate.

DON’T VERIFY HOSTNAME

I can pretend to be Google with any valid certificate.

SET SOME OPTIONS

• acceptable ciphers

• disable SSL 2.0

THAT’S ALL!

USERS

FUNDAMENTAL MISCONCEPTIONS


• no end-to-end security


• no end-to-end security

• metadata

VPN?

VPN?

• sees all your traffic

VPN?

• sees all your traffic

• same for CDN

CERTIFICATE WARNINIGS

CERTIFICATE WARNINIGS

ROOT CERTIFICATE POISONING

TRUST ISSUES

TRUST ISSUES

TRUST ISSUES

TRUST ISSUES

TRUST ISSUES• hacked


• screw up


• screw up

• court orders


• screw up

• court orders

• big corp

DON’T DO IT YOURSELF IF YOU CAN HELP IT.

Rule of Thumb

STANDARD LIBRARY VS.

PYOPENSSL

STANDARD LIBRARY

STANDARD LIBRARY• terrible pre-3.3


• very incomplete in 2.7



• PFS impossible



• PFS impossible

• missing options



• PFS impossible

• missing options

• bound to Python’s OpenSSL


3.2– from ssl import match_hostname

2.4–2.7 pip install backports.ssl_match_hostname

PYOPENSSL

PYOPENSSL

• Python 2.6+, 3.2+, and PyPy

PYOPENSSL


• more complete API coverage

PYOPENSSL


• more complete API coverage

• PyCA cryptography!

CRYPTOGRAPHY.IO

CRYPTOGRAPHY.IO• Python crypto w/o footguns


• PyCA


• PyCA

• PyPy ♥ CFFI


• PyCA

• PyPy ♥ CFFI

• gives pyOpenSSL momentum


service_identity

LIBRARIES &

FRAMEWORKS

SERVERSlib PFS good defaults configurable

eventlet hybrid ❌ ❌ ❌

gevent stdlib ❌ ❌ ❌

gunicorn depends ❌ ❌ ❌

Tornado stdlib ❌ ❌ ❌






Twisted 14.0 pyOpenSSL ✔️ ✔️ ✔️







uWSGI own C code ✔️ ❌ ✔️







uWSGI own C code ✔️ ❌ ✔️

CLIENTSlib verifies

certificatesverifies

hostnames good defaults



CLIENTSlib verifies





Tornado stdlib ✔️ ✔️ ❌

CLIENTSlib verifies






Twisted 14.0 pyOpenSSL depends depends ✔️

CLIENTSlib verifies







urllib2 stdlib ❌ ❌ ❌

CLIENTSlib verifies







urllib2 stdlib ❌ ❌ ❌

urllib3/requests hybrid ✔️ ✔️ ✔️

SUMMARY

SUMMARY

• keep TLS out of Python if you can

SUMMARY


• use pyOpenSSL-powered requests for HTTPS

SUMMARY



• write servers in Twisted

SUMMARY




• use pyOpenSSL

SUMMARY




• use pyOpenSSL

• use Python 2 stdlib only for clients

WHY SORRY?

IMPLEMENTATIONS

IMPLEMENTATIONS

USERS

USERS

• run outdated software

USERS


• click certificate warnings away

USERS


• click certificate warnings away

• are at the mercy of 3rd parties

SERVERS

SERVERS

CLIENTS

PYTHON

Is at the forefront of terrible.

HOPE

HOPE

• people care again

HOPE


• stdlib

HOPE


• stdlib

• PyCA

CALLS TO ACTION

CALLS TO ACTION

CALLS TO ACTION

CALLS TO ACTION

CALLS TO ACTION

ox.cx/t@hynek

vrmd.de

Date post:	26-Jan-2015
Category:	Education
Upload:	it-people
View:	590 times
Download:	1 times

"The Sorry State of SSL" Hynek Schlawack, PyConRu 2014

Education