From nmav at gnutls.org  Tue Jul  4 07:59:08 2017
From: nmav at gnutls.org (Nikos Mavrogiannopoulos)
Date: Tue, 04 Jul 2017 07:59:08 +0200
Subject: [gnutls-help] gnutls 3.3.28
Message-ID: <1499147948.26324.1.camel@gnutls.org>

Hello,?
?I've just released gnutls 3.3.28. This is a bug-fix release on
the previous stable branch.

* Version 3.3.28 (released 2017-07-04)

** libgnutls: Fixed issue when rehandshaking without a client certificate in
???a session which initially used one. Reported by Frantisek Sumsal.

** libgnutls: fix issue in RSA-PSK client callback which resulted in no username
???being sent to the peer. Patch by Nicolas Dufresne.

** libgnutls: no longer parse the ResponseID field of the status response
???TLS extension. The field is not used by GnuTLS nor is made available to
???calling applications. That addresses a null pointer dereference on server
???side caused by packets containing the ResponseID field. Reported
???by Hubert Kario. [GNUTLS-SA-2017-4]

** libgnutls: Handle specially HSMs which request explicit authentication.
???There are HSMs which return CKR_USER_NOT_LOGGED_IN on the first private key
???operation. Detect that state and try to login.

** libgnutls: the GNUTLS_PKCS11_OBJ_FLAG_LOGIN will force a login on HSMs.
???That is, even in tokens which do not have a CKF_LOGIN_REQUIRED flag
???a login will be forced. This improves operation on certain Safenet HSMs.

** libgnutls: do not set leading zeros when copying integers on HSMs.
???PKCS#11 defines integers as unsigned having most significant byte
???first, e.g., 32768 = 0x80 0x00. This is interpreted literraly by
???some HSMs which do not accept an integer with a leading zero. This
???improves operation with certain Atos HSMs.

** libgnutls: Backported PKCS#11 key generation functionality for DSA keys.

** libgnutls: Improve check for /dev/urandom uniqueness. Ensure that when
???gnutls_global_init() is called for a second time that /dev/urandom is
???re-opened when the inode or device ID has changed.

** API and ABI modifications:
No changes since last version.


Getting the Software
====================

GnuTLS may be downloaded directly from
<ftp://ftp.gnutls.org/gcrypt/gnutls/>.??A list of GnuTLS mirrors can be
found at <http://www.gnutls.org/download.html>.

Here are the XZ compressed sources:

? ftp://ftp.gnutls.org/gcrypt/gnutls/v3.3/gnutls-3.3.28.tar.xz

Here are OpenPGP detached signatures signed using key 0x96865171:

? ftp://ftp.gnutls.org/gcrypt/gnutls/v3.3/gnutls-3.3.28.tar.xz.sig

Note that it has been signed with my openpgp key:
pub???3104R/96865171 2008-05-04 [expires: 2028-04-29]
uid??????????????????Nikos Mavrogiannopoulos <nmav <at> gnutls.org>
uid??????????????????Nikos Mavrogiannopoulos <n.mavrogiannopoulos <at>
gmail.com>
sub???2048R/9013B842 2008-05-04 [expires: 2018-05-02]
sub???2048R/1404A91D 2008-05-04 [expires: 2018-05-02]

regards,
Nikos



From nmav at gnutls.org  Tue Jul  4 08:00:59 2017
From: nmav at gnutls.org (Nikos Mavrogiannopoulos)
Date: Tue, 04 Jul 2017 08:00:59 +0200
Subject: [gnutls-help] gnutls 3.5.14
Message-ID: <1499148059.26324.3.camel@gnutls.org>

Hello,?
?I've just released gnutls 3.5.14. This is a bug fix release on the
3.5.x branch.

* Version 3.5.14 (released 2017-07-04)

** libgnutls: Handle specially HSMs which request explicit authentication.
???There are HSMs which return CKR_USER_NOT_LOGGED_IN on the first private key
???operation. Detect that state and try to login.

** libgnutls: the GNUTLS_PKCS11_OBJ_FLAG_LOGIN will force a login on HSMs.
???That is, even in tokens which do not have a CKF_LOGIN_REQUIRED flag
???a login will be forced. This improves operation on certain Safenet HSMs.

** libgnutls: do not set leading zeros when copying integers on HSMs.
???PKCS#11 defines integers as unsigned having most significant byte
???first, e.g., 32768 = 0x80 0x00. This is interpreted literraly by
???some HSMs which do not accept an integer with a leading zero. This
???improves operation with certain Atos HSMs.

** libgnutls: Fixed issue discovering certain OCSP signers, and improved the
???discovery of OCSP signer in the case where the Subject Public Key
???identifier field matches. Resolves gitlab issue #223.

** gnutls-cli: ensure OCSP responses are saved with --save-ocsp even if
???certificate verification fails.

** API and ABI modifications:
No changes since last version.

Getting the Software
====================

GnuTLS may be downloaded directly from
<ftp://ftp.gnutls.org/gcrypt/gnutls/>.??A list of GnuTLS mirrors can be
found at <http://www.gnutls.org/download.html>.

Here are the XZ compressed sources:

? ftp://ftp.gnutls.org/gcrypt/gnutls/v3.5/gnutls-3.5.14.tar.xz

Here are OpenPGP detached signatures signed using key 0x96865171:

? ftp://ftp.gnutls.org/gcrypt/gnutls/v3.5/gnutls-3.5.14.tar.xz.sig

Note that it has been signed with my openpgp key:
pub???3104R/96865171 2008-05-04 [expires: 2028-04-29]
uid??????????????????Nikos Mavrogiannopoulos <nmav <at> gnutls.org>
uid??????????????????Nikos Mavrogiannopoulos <n.mavrogiannopoulos <at>
gmail.com>
sub???2048R/9013B842 2008-05-04 [expires: 2018-05-02]
sub???2048R/1404A91D 2008-05-04 [expires: 2018-05-02]

regards,
Nikos



From paulepanter at users.sourceforge.net  Mon Jul 10 20:44:14 2017
From: paulepanter at users.sourceforge.net (Paul Menzel)
Date: Mon, 10 Jul 2017 20:44:14 +0200
Subject: [gnutls-help] How to deal with multiple certificate chains?
Message-ID: <1499712254.2017.24.camel@users.sourceforge.net>

Dear GnuTLS folks,


There is a regression in the banking software AqBanking [1] after the
removal of a certificate with a short hash. AqBanking uses Gwenhywfar,
which uses GnuTLS.

The good thing is, that the GnuTLS tools work.

> Status: The certificate is trusted.

```
$ echo "" | gnutls-cli hbci11.fiducia.de 443
Processed 166 CA certificate(s).
Resolving 'hbci11.fiducia.de:443'...
Connecting to '195.200.35.18:443'...
- Certificate type: X.509
- Got a certificate list of 3 certificates.
- Certificate[0] info:
 - subject `CN=hbci11.fiducia.de,OU=Produktion,O=Fiducia & GAD IT AG,L=Karlsruhe,ST=Baden-Wuerttemberg,C=DE', issuer `CN=Symantec Class 3 Secure Server CA - G4,OU=Symantec Trust Network,O=Symantec Corporation,C=US', serial 0x4ea797384997e61f9294b5ea9dd6dd71, RSA key 2048 bits, signed using RSA-SHA256, activated `2016-05-04 00:00:00 UTC', expires `2017-08-03 23:59:59 UTC', pin-sha256="zonnfxgRNRjW4PB/K413ypyNzEt1Csmh9FbSl3aeA1U="
	Public Key ID:
		sha1:b3b832d4acd3ba172cffd79969f83d60dd3be5c4
		sha256:ce89e77f18113518d6e0f07f2b8d77ca9c8dcc4b750ac9a1f456d297769e0355
	Public Key PIN:
		pin-sha256:zonnfxgRNRjW4PB/K413ypyNzEt1Csmh9FbSl3aeA1U=
	Public key's random art:
		+--[ RSA 2048]----+
		|                 |
		|                 |
		|                 |
		|                 |
		|     +  S    . o |
		|    o =. o  o . E|
		|   . =...  + = oo|
		|    = +.  o *..o.|
		|    oB.... o. ...|
		+-----------------+

- Certificate[1] info:
 - subject `CN=Symantec Class 3 Secure Server CA - G4,OU=Symantec Trust Network,O=Symantec Corporation,C=US', issuer `CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=(c) 2006 VeriSign\, Inc. - For authorized use only,OU=VeriSign Trust Network,O=VeriSign\, Inc.,C=US', serial 0x513fb9743870b73440418d30930699ff, RSA key 2048 bits, signed using RSA-SHA256, activated `2013-10-31 00:00:00 UTC', expires `2023-10-30 23:59:59 UTC', pin-sha256="9n0izTnSRF+W4W4JTq51avSXkWhQB8duS2bxVLfzXsY="
- Certificate[2] info:
 - subject `CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=(c) 2006 VeriSign\, Inc. - For authorized use only,OU=VeriSign Trust Network,O=VeriSign\, Inc.,C=US', issuer `OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US', serial 0x250ce8e030612e9f2b89f7054d7cf8fd, RSA key 2048 bits, signed using RSA-SHA1, activated `2006-11-08 00:00:00 UTC', expires `2021-11-07 23:59:59 UTC', pin-sha256="JbQbUG5JMJUoI6brnx0x3vZF6jilxsapbXGVfjhN8Fg="
- Status: The certificate is trusted. 
- Description: (TLS1.2)-(ECDHE-RSA-SECP256R1)-(AES-256-GCM)
- Session ID: A6:CC:C9:86:3B:50:7D:AA:0F:14:F4:78:22:19:A4:B2:83:A5:9E:AF:C4:13:FD:8E:64:86:A2:46:F2:A9:F4:C3
- Ephemeral EC Diffie-Hellman parameters
 - Using curve: SECP256R1
 - Curve size: 256 bits
- Version: TLS1.2
- Key Exchange: ECDHE-RSA
- Server Signature: RSA-SHA256
- Cipher: AES-256-GCM
- MAC: AEAD
- Compression: NULL
- Options: safe renegotiation,
- Handshake was completed

- Simple Client Mode:
```

Now, if Gwenhywfar is used, a different certificate chain is used.

Long certificate chain with intermediate certificate and old root
certificate 1,3,5,6 or 2,4,5,6 for hbci.postbank.de and
hbci11.fiducia.de.

6: VeriSign Class 3 Public Primary Certification Authority? (root CA, 1024 bit RSA key)
????? |
????? V
5: VeriSign Class 3 Public Primary Certification Authority - G5?? (intermediate)
????? |???????????????????????????????????????????????? |
????? V???????????????????????????????????????????????? V
3: Symantec Class 3 EV SSL CA - G3???????????? 4: Symantec Class 3 Secure Server CA - G4
????? |???????????????????????????????????????????????? |
????? V???????????????????????????????????????????????? V
1: hbci.postbank.de??????????????????????????? 2: hbci11.fiducia.de

----------------------------------------------------------------------------------------

Short certificate chain without intermediate certificates 1,3,7 or 2,4,7:

7: VeriSign Class 3 Public Primary Certification Authority - G5?? (root CA, 2048 bit RSA)
????? |???????????????????????????????????????????????? |
????? V???????????????????????????????????????????????? V
3: Symantec Class 3 EV SSL CA - G3???????????? 4: Symantec Class 3 Secure Server CA - G4
????? |???????????????????????????????????????????????? |
????? V???????????????????????????????????????????????? V
1: hbci.postbank.de??????????????????????????? 2: hbci11.fiducia.de

Could you please help how to deal with this situation? The code calls
`gnutls_certificate_verify_peers2()` in line 640 [2].

```
[?]
  rv=gnutls_certificate_verify_peers2(xio->session, &status);
  if (rv<0) {
    DBG_INFO(GWEN_LOGDOMAIN, "gnutls_certificate_verify_peers2: %d (%s)", rv, gnutls_strerror(rv));
    GWEN_SslCertDescr_free(certDescr);
    return GWEN_ERROR_SSL_SECURITY;
  }

  if (gnutls_certificate_type_get(xio->session)!=GNUTLS_CRT_X509) {
    DBG_INFO(GWEN_LOGDOMAIN, "Certificate is not X.509");

    GWEN_SslCertDescr_free(certDescr);
    return GWEN_ERROR_SSL_SECURITY;
  }

  if (status & GNUTLS_CERT_SIGNER_NOT_FOUND) {
    DBG_INFO(GWEN_LOGDOMAIN, "Signer not found");
    GWEN_Gui_ProgressLog(0, GWEN_LoggerLevel_Warning,
                         I18N("Signer not found"));
    errFlags|=GWEN_SSL_CERT_FLAGS_SIGNER_NOT_FOUND;
  }

  if (status & GNUTLS_CERT_INVALID) {
    DBG_INFO(GWEN_LOGDOMAIN, "Certificate is not trusted");
    GWEN_Gui_ProgressLog(0, GWEN_LoggerLevel_Warning,
                         I18N("Certificate is not trusted"));
    errFlags|=GWEN_SSL_CERT_FLAGS_INVALID;
  }
[?]
```


Thanks,

Paul


[1] https://www.aquamaniac.de/sites/aqbanking/
[2] https://sources.debian.net/src/libgwenhywfar/4.17.0-3/src/sio/syncio_tls.c/#L640
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: This is a digitally signed message part
URL: </pipermail/attachments/20170710/add8d205/attachment.sig>

From nmav at gnutls.org  Tue Jul 11 10:39:08 2017
From: nmav at gnutls.org (Nikos Mavrogiannopoulos)
Date: Tue, 11 Jul 2017 10:39:08 +0200
Subject: [gnutls-help] How to deal with multiple certificate chains?
In-Reply-To: <1499712254.2017.24.camel@users.sourceforge.net>
References: <1499712254.2017.24.camel@users.sourceforge.net>
Message-ID: <CAJU7zaLPw948qW6uqMUGHmHL5X2=Ftn_NNYEQ6pan8OOwxP7Hw@mail.gmail.com>

On Mon, Jul 10, 2017 at 8:44 PM, Paul Menzel
<paulepanter at users.sourceforge.net> wrote:
> Dear GnuTLS folks,
>
>
> There is a regression in the banking software AqBanking [1] after the
> removal of a certificate with a short hash. AqBanking uses Gwenhywfar,
> which uses GnuTLS.
>
> The good thing is, that the GnuTLS tools work.
>
>> Status: The certificate is trusted.
[...]
> Now, if Gwenhywfar is used, a different certificate chain is used.

How did you verify that a different chain is used? Have you checked
the differences in the wireshark traces between gnutls-cli and the
application you use?

regards,
Nikos


From maxdaw at gmail.com  Wed Jul 12 04:36:05 2017
From: maxdaw at gmail.com (Max Teo)
Date: Wed, 12 Jul 2017 10:36:05 +0800
Subject: [gnutls-help] libnettle still not found
Message-ID: <CAA4mT18tYAybAtBPvcx1tt0OiSwnkMw+h4A18U38E7K8z9jhog@mail.gmail.com>

Hi,

I am trying to get windows build version of GnuTLS 3.5.12 working, but no
matter how amount of playing with cross.mk file, I still can't get it to
compile successfully.

I can install nettle 3.1 successfully using
./configure --prefix=/usr && make && make install

But why did cross.mk complain that's not found?

I retrieve the cross,mk from https://gitlab.com/gnutls
/gnutls/blob/master/cross.mk

What am I missing? Can point me in the direction what to check for in the
system?

Using Debian Jessie release.
libnettle2.7 is by default installed and there's no way I could uninstall
that as it seems that by uninstalling, the OS becomes unusable.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: </pipermail/attachments/20170712/68aa5ad6/attachment.html>

From chengwei.clx at gmail.com  Thu Jul 13 13:32:57 2017
From: chengwei.clx at gmail.com (Wei Cheng)
Date: Thu, 13 Jul 2017 19:32:57 +0800
Subject: [gnutls-help] (no subject)
Message-ID: <CAJM8vyhasq+NjrZjh3Gg3A-56C2ovAG04OUdSEKsBzxiPfT1ag@mail.gmail.com>

hi,
digital signature, use private key to encrypt MAC(message authorization
code) ,

in TLS1.2, HAMC is used ,MAC will be encrypted with a key which is created
during the handshake.

is it necessary to use private key to encrypt the HAMC for non-repudiation?

Is the digital signature optional in TLS?

i think it is necessary to encrypt HMAC of every record,but I'm not sure
about that.

thanks in advance!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: </pipermail/attachments/20170713/649b4504/attachment.html>

From dkg at fifthhorseman.net  Sat Jul 15 12:22:02 2017
From: dkg at fifthhorseman.net (Daniel Kahn Gillmor)
Date: Sat, 15 Jul 2017 12:22:02 +0200
Subject: [gnutls-help] libnettle still not found
In-Reply-To: <CAA4mT18tYAybAtBPvcx1tt0OiSwnkMw+h4A18U38E7K8z9jhog@mail.gmail.com>
References: <CAA4mT18tYAybAtBPvcx1tt0OiSwnkMw+h4A18U38E7K8z9jhog@mail.gmail.com>
Message-ID: <877ezarodx.fsf@fifthhorseman.net>

Hi Max--

On Wed 2017-07-12 10:36:05 +0800, Max Teo wrote:

> I am trying to get windows build version of GnuTLS 3.5.12 working, but no
> matter how amount of playing with cross.mk file, I still can't get it to
> compile successfully.
>
> I can install nettle 3.1 successfully using
> ./configure --prefix=/usr && make && make install
>
> But why did cross.mk complain that's not found?
>
> I retrieve the cross,mk from https://gitlab.com/gnutls
> /gnutls/blob/master/cross.mk
>
> What am I missing? Can point me in the direction what to check for in the
> system?
>
> Using Debian Jessie release.
> libnettle2.7 is by default installed and there's no way I could uninstall
> that as it seems that by uninstalling, the OS becomes unusable.

i don't think you need to uninstall it, as the two different versions of
nettle should be able to live side-by-side.

have you tried installing the following packages from the current debian
stable (stretch) directly?

 * libnettle6
 * libhogweed4
 * nettle-dev

or, can you just upgrade to stretch? :)

 --dkg


From maxdaw at gmail.com  Mon Jul 17 05:32:20 2017
From: maxdaw at gmail.com (Max Teo)
Date: Mon, 17 Jul 2017 11:32:20 +0800
Subject: [gnutls-help] libnettle still not found
In-Reply-To: <877ezarodx.fsf@fifthhorseman.net>
References: <CAA4mT18tYAybAtBPvcx1tt0OiSwnkMw+h4A18U38E7K8z9jhog@mail.gmail.com>
 <877ezarodx.fsf@fifthhorseman.net>
Message-ID: <CAA4mT1-xJzZnOSAFokU4JhqFXx92hsbtgmNs78tU-4UTSPSXuw@mail.gmail.com>

Hi Daniel,

I had upgraded to stretch (debian), installed all the packages you
mentioned.

from configure.ac, I noticed this line

with_old_nettle=no
if ! $PKG_CONFIG --atleast-version=3.3 nettle; then
with_old_nettle=yes

I had installed that version 3.3 as well, but still get the error libnettle
3.1 not found.

I tried 3.1 as well, but to no avail.

It's very tedious. What's missing?


On Sat, Jul 15, 2017 at 6:22 PM, Daniel Kahn Gillmor <dkg at fifthhorseman.net>
wrote:

> Hi Max--
>
> On Wed 2017-07-12 10:36:05 +0800, Max Teo wrote:
>
> > I am trying to get windows build version of GnuTLS 3.5.12 working, but no
> > matter how amount of playing with cross.mk file, I still can't get it to
> > compile successfully.
> >
> > I can install nettle 3.1 successfully using
> > ./configure --prefix=/usr && make && make install
> >
> > But why did cross.mk complain that's not found?
> >
> > I retrieve the cross,mk from https://gitlab.com/gnutls
> > /gnutls/blob/master/cross.mk
> >
> > What am I missing? Can point me in the direction what to check for in the
> > system?
> >
> > Using Debian Jessie release.
> > libnettle2.7 is by default installed and there's no way I could uninstall
> > that as it seems that by uninstalling, the OS becomes unusable.
>
> i don't think you need to uninstall it, as the two different versions of
> nettle should be able to live side-by-side.
>
> have you tried installing the following packages from the current debian
> stable (stretch) directly?
>
>  * libnettle6
>  * libhogweed4
>  * nettle-dev
>
> or, can you just upgrade to stretch? :)
>
>  --dkg
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: </pipermail/attachments/20170717/75142d45/attachment.html>

From rick at openfortress.nl  Tue Jul 18 15:22:28 2017
From: rick at openfortress.nl (Rick van Rein)
Date: Tue, 18 Jul 2017 15:22:28 +0200
Subject: [gnutls-help] Multi-tenancy and PKCS #11
In-Reply-To: <596C9BAE.2020501@openfortress.nl>
References: <596C9BAE.2020501@openfortress.nl>
Message-ID: <596E0B94.90709@openfortress.nl>

Hello Nikos,

As you know, I am building a TLS Pool which separates applications from
TLS security.  I have requests to make this into a multi-tenant process,
so it could run on a client machine and service each client without
interference.

https://github.com/arpa2/tlspool/issues/36

This is a nettly request, but most things are now starting to resolve. 
One thing that may be blocking it, is the fact that GnuTLS has a global
setup for PKCS #11, including the available tokens and their PINs.  Is
that correct, or is there a way to get around this?

I do realise that GnuTLS is a library, and was not design with a
multi-tenant mindset.  So if this is the stopper of the multi-tenancy
show than that does not indicate to me that GnuTLS is bad :) just that a
multi-tenant TLS Pool would be stretching it too far.

Thanks,
 -Rick



From nmav at gnutls.org  Wed Jul 19 06:00:18 2017
From: nmav at gnutls.org (Nikos Mavrogiannopoulos)
Date: Wed, 19 Jul 2017 06:00:18 +0200
Subject: [gnutls-help] Multi-tenancy and PKCS #11
In-Reply-To: <596E0B94.90709@openfortress.nl>
References: <596C9BAE.2020501@openfortress.nl> <596E0B94.90709@openfortress.nl>
Message-ID: <CAJU7za+vnF=U-Jq1c74mmeJ1Ppkg=J-kYj9fQgJzPbmgGRTD9w@mail.gmail.com>

On Tue, Jul 18, 2017 at 3:22 PM, Rick van Rein <rick at openfortress.nl> wrote:
> Hello Nikos,
>
> As you know, I am building a TLS Pool which separates applications from
> TLS security.  I have requests to make this into a multi-tenant process,
> so it could run on a client machine and service each client without
> interference.
>
> https://github.com/arpa2/tlspool/issues/36
>
> This is a nettly request, but most things are now starting to resolve.
> One thing that may be blocking it, is the fact that GnuTLS has a global
> setup for PKCS #11, including the available tokens and their PINs.  Is
> that correct, or is there a way to get around this?

Could you describe the ideal situation of handling smart cards for the
use case above? The situation in gnutls is that pkcs11 shared modules
are loaded globally, pins etc are cached/used per private key,
operation.

> I do realise that GnuTLS is a library, and was not design with a
> multi-tenant mindset.  So if this is the stopper of the multi-tenancy
> show than that does not indicate to me that GnuTLS is bad :) just that a
> multi-tenant TLS Pool would be stretching it too far.

Note that PKCS#11 utilizes global state per process and it may not be
possible to have various modules loaded by different parts of the
process without co-ordination.

regards,
Nikos


From rick at openfortress.nl  Wed Jul 19 11:12:19 2017
From: rick at openfortress.nl (Rick van Rein)
Date: Wed, 19 Jul 2017 11:12:19 +0200
Subject: [gnutls-help] Multi-tenancy and PKCS #11
In-Reply-To: <CAJU7za+vnF=U-Jq1c74mmeJ1Ppkg=J-kYj9fQgJzPbmgGRTD9w@mail.gmail.com>
References: <596C9BAE.2020501@openfortress.nl> <596E0B94.90709@openfortress.nl>
 <CAJU7za+vnF=U-Jq1c74mmeJ1Ppkg=J-kYj9fQgJzPbmgGRTD9w@mail.gmail.com>
Message-ID: <596F2273.5020402@openfortress.nl>

Hi,

>> One thing that may be blocking it, is the fact that GnuTLS has a global
>> setup for PKCS #11, including the available tokens and their PINs.  Is
>> that correct, or is there a way to get around this?
>
> Could you describe the ideal situation of handling smart cards for the
> use case above?

The design alternative that I'm exploring is one in which the TLS Pool is
a networked component, serving to multiple daemons, and/or where each
daemon can run on behalf of various domain names.  Ideally, the credentials
of each domain name would be kept separate in the TLS Pool, rather than
trusting the daemon to do the right thing.  The daemon is closer to the
protocols and parsers of the application, after all, and the whole idea of
the TLS Pool is keeping application logic and security logic separated.

> The situation in gnutls is that pkcs11 shared modules
> are loaded globally, pins etc are cached/used per private key,
> operation.

The PINs may be the solution then.  You didn't write down the precise
logic, right?  Well you did, of course, in the code :) so maybe I should
take a look there.  I had assumed PINs were strictly delegated to p11-kit.

> Note that PKCS#11 utilizes global state per process

Yes, I've been thinking along the lines of separating the various
users (daemons/domains) of a networked TLS Pool into processes.  This
is not how we design all our systems these days, but it makes sense
from a security perspective to split PKCS #11 access into processes.
I'd have to see what that means to BerkeleyDB access too.

> and it may not be
> possible to have various modules loaded by different parts of the
> process without co-ordination.

That's what I was afraid of.  It's probably the way p11-kit works,
anyway, since PKCS #11 is considered a loaded library to a process.
I suppose separating processes is the best way forward then.

As you can tell, I'm in a sort of dynamic state on this, thanks for
helping me fence off the search space.


Cheers,
 -Rick


From nmav at gnutls.org  Wed Jul 19 17:10:11 2017
From: nmav at gnutls.org (Nikos Mavrogiannopoulos)
Date: Wed, 19 Jul 2017 17:10:11 +0200
Subject: [gnutls-help] Multi-tenancy and PKCS #11
In-Reply-To: <596F2273.5020402@openfortress.nl>
References: <596C9BAE.2020501@openfortress.nl> <596E0B94.90709@openfortress.nl>
 <CAJU7za+vnF=U-Jq1c74mmeJ1Ppkg=J-kYj9fQgJzPbmgGRTD9w@mail.gmail.com>
 <596F2273.5020402@openfortress.nl>
Message-ID: <CAJU7zaJxDcaJ0bonh4QJ0eJ_3Qt4jkGLafPezt+Z98ux-W=OGg@mail.gmail.com>

On Wed, Jul 19, 2017 at 11:12 AM, Rick van Rein <rick at openfortress.nl> wrote:
> Hi,
>
>>> One thing that may be blocking it, is the fact that GnuTLS has a global
>>> setup for PKCS #11, including the available tokens and their PINs.  Is
>>> that correct, or is there a way to get around this?
>>
>> Could you describe the ideal situation of handling smart cards for the
>> use case above?
>
> The design alternative that I'm exploring is one in which the TLS Pool is
> a networked component, serving to multiple daemons, and/or where each
> daemon can run on behalf of various domain names.  Ideally, the credentials
> of each domain name would be kept separate in the TLS Pool, rather than
> trusting the daemon to do the right thing.  The daemon is closer to the
> protocols and parsers of the application, after all, and the whole idea of
> the TLS Pool is keeping application logic and security logic separated.
>
>> The situation in gnutls is that pkcs11 shared modules
>> are loaded globally, pins etc are cached/used per private key,
>> operation.
>
> The PINs may be the solution then.  You didn't write down the precise
> logic, right?  Well you did, of course, in the code :) so maybe I should
> take a look there.  I had assumed PINs were strictly delegated to p11-kit.

You may want to check gnutls_pkcs11_privkey_t handling. Only the
shared module should be global on its handling. Everything else is
local to the object.

regards,
Nikos


From rick at openfortress.nl  Wed Jul 19 21:15:04 2017
From: rick at openfortress.nl (Rick van Rein)
Date: Wed, 19 Jul 2017 21:15:04 +0200
Subject: [gnutls-help] Multi-tenancy and PKCS #11
In-Reply-To: <596FAF6A.2080105@openfortress.nl>
References: <596C9BAE.2020501@openfortress.nl> <596E0B94.90709@openfortress.nl>
 <CAJU7za+vnF=U-Jq1c74mmeJ1Ppkg=J-kYj9fQgJzPbmgGRTD9w@mail.gmail.com>
 <596F2273.5020402@openfortress.nl>
 <CAJU7zaJxDcaJ0bonh4QJ0eJ_3Qt4jkGLafPezt+Z98ux-W=OGg@mail.gmail.com>
 <596FAF6A.2080105@openfortress.nl>
Message-ID: <596FAFB8.5010804@openfortress.nl>

Ah,

> You may want to check gnutls_pkcs11_privkey_t handling. Only the
> shared module should be global on its handling. Everything else is
> local to the object.

That's helpful.

1. Modules are in the globals providers / #active_providers in pkcs11.c
2. A global _gnutls_pin_func is set from gnutls_pkcs11_set_pin_function(),
   or a per-privkey pin_info is set from gnutls_pkcs11_privkey_set_pin_function()

In short, limiting visibility of modules to clients remains one concern
(mostly one of privacy) but the major concern (of security) through
visibility of the PIN between clients can probably be achieved already.

Good, now I know where and how to scratch my head over this design issue.


Thanks!
 -Rick



From maxdaw at gmail.com  Thu Jul 20 09:40:42 2017
From: maxdaw at gmail.com (Max Teo)
Date: Thu, 20 Jul 2017 15:40:42 +0800
Subject: [gnutls-help] libnettle still not found
In-Reply-To: <877ezarodx.fsf@fifthhorseman.net>
References: <CAA4mT18tYAybAtBPvcx1tt0OiSwnkMw+h4A18U38E7K8z9jhog@mail.gmail.com>
 <877ezarodx.fsf@fifthhorseman.net>
Message-ID: <CAA4mT19PxyiiDLWrWFt+tPYGakcxWL4etju_dPbXaBxaGpWrQg@mail.gmail.com>

Hi,

If would be helpful if anybody could provide me some pointers.
Thanks


On Mon, Jul 17, 2017 at 11:32 AM, Max Teo <maxdaw at gmail.com> wrote:
Hi Daniel,

I had upgraded to stretch (debian), installed all the packages you
mentioned.

from configure.ac, I noticed this line

with_old_nettle=no
if ! $PKG_CONFIG --atleast-version=3.3 nettle; then
with_old_nettle=yes

I had installed that version 3.3 as well, but still get the error libnettle
3.1 not found.

I tried 3.1 as well, but to no avail.

It's very tedious. What's missing?


On Sat, Jul 15, 2017 at 6:22 PM, Daniel Kahn Gillmor <dkg at fifthhorseman.net>
wrote:

> Hi Max--
>
> On Wed 2017-07-12 10:36:05 +0800, Max Teo wrote:
>
> > I am trying to get windows build version of GnuTLS 3.5.12 working, but no
> > matter how amount of playing with cross.mk file, I still can't get it to
> > compile successfully.
> >
> > I can install nettle 3.1 successfully using
> > ./configure --prefix=/usr && make && make install
> >
> > But why did cross.mk complain that's not found?
> >
> > I retrieve the cross,mk from https://gitlab.com/gnutls
> > /gnutls/blob/master/cross.mk
> >
> > What am I missing? Can point me in the direction what to check for in the
> > system?
> >
> > Using Debian Jessie release.
> > libnettle2.7 is by default installed and there's no way I could uninstall
> > that as it seems that by uninstalling, the OS becomes unusable.
>
> i don't think you need to uninstall it, as the two different versions of
> nettle should be able to live side-by-side.
>
> have you tried installing the following packages from the current debian
> stable (stretch) directly?
>
>  * libnettle6
>  * libhogweed4
>  * nettle-dev
>
> or, can you just upgrade to stretch? :)
>
>  --dkg
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: </pipermail/attachments/20170720/88a8071f/attachment-0001.html>

From dkg at fifthhorseman.net  Fri Jul 21 20:35:43 2017
From: dkg at fifthhorseman.net (Daniel Kahn Gillmor)
Date: Fri, 21 Jul 2017 14:35:43 -0400
Subject: [gnutls-help] libnettle still not found
In-Reply-To: <CAA4mT1-xJzZnOSAFokU4JhqFXx92hsbtgmNs78tU-4UTSPSXuw@mail.gmail.com>
References: <CAA4mT18tYAybAtBPvcx1tt0OiSwnkMw+h4A18U38E7K8z9jhog@mail.gmail.com>
 <877ezarodx.fsf@fifthhorseman.net>
 <CAA4mT1-xJzZnOSAFokU4JhqFXx92hsbtgmNs78tU-4UTSPSXuw@mail.gmail.com>
Message-ID: <87fudptz7k.fsf@fifthhorseman.net>

On Mon 2017-07-17 11:32:20 +0800, Max Teo wrote:

> I had upgraded to stretch (debian), installed all the packages you
> mentioned.

great, glad to hear it.

> from configure.ac, I noticed this line
>
> with_old_nettle=no
> if ! $PKG_CONFIG --atleast-version=3.3 nettle; then
> with_old_nettle=yes
>
> I had installed that version 3.3 as well, but still get the error libnettle
> 3.1 not found.
>
> I tried 3.1 as well, but to no avail.
>
> It's very tedious. What's missing?

i'm sorry, but I don't know what's going on on your system.  can you
send a transcript of how you're trying to do the install, and what text
it produces?  Sharing the explicit error text that you're seeing might
give some help in debugging.

regards,

        --dkg


From chengwei.clx at gmail.com  Sun Jul 23 17:47:28 2017
From: chengwei.clx at gmail.com (Wei Cheng)
Date: Sun, 23 Jul 2017 23:47:28 +0800
Subject: [gnutls-help] pthread safety
Message-ID: <CAJM8vyggrVz8==YiQ6mPpY1=WSwO9oKtz4Jf1eOwdnJFVJc5BA@mail.gmail.com>

i want to use to child pthread to handshake with remote peer.
in my child pthead , i just use gnutls_handshake().

quetion one:
can i use pthread_cancel()  to cancel the child pthread regardless of the
current handshake state ?

question two:
if i have registered the pull/pull_timeout/push funciton with
pthread_cleanup_push/pthread_cleanup_pop,
can i cancel the child process?

thanks in advance.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: </pipermail/attachments/20170723/5605918e/attachment.html>

From chengwei.clx at gmail.com  Mon Jul 24 11:55:42 2017
From: chengwei.clx at gmail.com (Wei Cheng)
Date: Mon, 24 Jul 2017 17:55:42 +0800
Subject: [gnutls-help] pthread safety
In-Reply-To: <CAJM8vyggrVz8==YiQ6mPpY1=WSwO9oKtz4Jf1eOwdnJFVJc5BA@mail.gmail.com>
References: <CAJM8vyggrVz8==YiQ6mPpY1=WSwO9oKtz4Jf1eOwdnJFVJc5BA@mail.gmail.com>
Message-ID: <CAJM8vyhsFxDyFVFeiJV=rVDtyZctwOJ9edRTwDQTZM2+tHRU4A@mail.gmail.com>

sorry about my english,so i send again.thread safety in GNUTLS
<https://security.stackexchange.com/questions/165861/thread-safety-in-gnutls>

The version of GNUTLS is 3.5. I want to use a child thread to handshake
with remote peer. In my child thread, I just use gnutls_handshake().

   1.

   In the parent thread, can I use pthread_cancel() to cancel the child
   thread safety regardless of the current handshake state?
   2.

   If I have registered the pull/pull_timeout/push functions with
   pthread_cleanup_push/pthread_cleanup_pop, can I cancel the child thread?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: </pipermail/attachments/20170724/7f9f48eb/attachment.html>

From nmav at gnutls.org  Wed Jul 26 16:04:50 2017
From: nmav at gnutls.org (Nikos Mavrogiannopoulos)
Date: Wed, 26 Jul 2017 16:04:50 +0200
Subject: [gnutls-help] pthread safety
In-Reply-To: <CAJM8vyggrVz8==YiQ6mPpY1=WSwO9oKtz4Jf1eOwdnJFVJc5BA@mail.gmail.com>
References: <CAJM8vyggrVz8==YiQ6mPpY1=WSwO9oKtz4Jf1eOwdnJFVJc5BA@mail.gmail.com>
Message-ID: <CAJU7za+cDSQjftyjmmUnvMU4ocs-F7bwYe0X01O1kXZex2Qd_Q@mail.gmail.com>

On Sun, Jul 23, 2017 at 5:47 PM, Wei Cheng <chengwei.clx at gmail.com> wrote:
> i want to use to child pthread to handshake with remote peer.
> in my child pthead , i just use gnutls_handshake().
>
> quetion one:
> can i use pthread_cancel()  to cancel the child pthread regardless of the
> current handshake state ?

gnutls functions were never designed as pthread cancellation points. I
have not thought that much, but I believe your main concern is memory
leaks right? It may be that if you deallocate the session in another
thread it may just work; though you may have to create a stress test
for that to verify that this is possible.

> question two:
> if i have registered the pull/pull_timeout/push funciton with
> pthread_cleanup_push/pthread_cleanup_pop,
> can i cancel the child process?

I assume that you are describing threads (you can always terminate a
process). The answer is as above.

regards,
Nikos