[Gt-eos] TLS 1.3

[Mattias Ellert]

fre 2018-05-25 klockan 12:56 +0200 skrev Mischa Salle:
> Hi Frank, others,
> 
> On Thu, May 24, 2018 at 07:02:06PM +0200, Frank Scheiner wrote:
> > Hi Mischa, Mattias, others,
> > 
> > On 05/24/2018 02:56 PM, Mischa Salle wrote:
> > > Most is summarized in a wiki https://wiki.openssl.org/index.php/TLS1.3
> > > They also say there that 1.1.1 is not being released before TLS1.3 is
> > > actually released (currently still in draft:
> > > https://tools.ietf.org/html/draft-ietf-tls-tls13-28)
> > 
> > That's an important information, so currently not even the TLSv1.3 draft is
> > finished, hence the current implementation in OpenSSL 1.1.1 "pre-releases"
> > is also not final.
> 
> True. In any case, it's I think in Debian experimental such that we can
> figure out all these issues (-;

TLS 1.3 has been approved as a "Proposed Standard", but it is true it
is not yet an "Internet Standard".

https://www.ietf.org/mail-archive/web/ietf-announce/current/msg17592.html

> > For now could it not also be possible to link to OpenSSL 1.1.1 and still
> > limit usage of TLS to TLSv1.2?
> 
> I guess (although I couldn't yet figure out with a quick look how) that
> it is possible to compile code against OpenSSL such that it will default
> to TLSv1.2 (or something else) and never try TLSv1.3. On the other hand,
> it would be nice if we could make the globus-gsi code TLSv1.3 compliant.

I have created a PR that sets the maximum TLS version to 1.2, which
allows thing to run. But I consider this to be a temporary solution and
I too would like the code to be fixed to work with TLS 1.3.

https://github.com/gridcf/gct/pull/44

> > Because the wiki article says below "Ciphersuites":
> > ``
> > [...]
> > OpenSSL has implemented support for five TLSv1.3 ciphersuites as follows:
> > 
> >     TLS_AES_256_GCM_SHA384
> >     TLS_CHACHA20_POLY1305_SHA256
> >     TLS_AES_128_GCM_SHA256
> > [...]
> > By default the first three of the above ciphersuites are enabled by default.
> > This means that if you have no explicit ciphersuite configuration then you
> > will automatically use those three and will be able to negotiate TLSv1.3.
> > [...]
> > ```
> > ...so it looks to me like it defaults to TLSv1.3, but maybe this can be
> > changed by a switch or an option.
> 
> I guess also that this can be changed at compile (or run) time...
> 
>     Cheers,
>     Mischa
> 
> > And if I understand the following note from [1] correctly:
> > ```
> > Note that at this stage only TLSv1.3 is supported. DTLSv1.3 is still in the
> > early days of specification and there is no OpenSSL support for it at this
> > time.
> > ```
> > ...there is also currently no TLSv1.3 equivalent for UDT (i.e. no DTLSv1.3).
> > 
> > [1]:
> > https://wiki.openssl.org/index.php/TLS1.3#Differences_with_TLS1.2_and_below
> > 
> > Cheers,
> > Frank
> > 
> > -- 
> > Frank Scheiner
> > 
> > High Performance Computing Center Stuttgart (HLRS)
> > Department Project User Management & Accounting
> > 
> > Email: scheiner at hlrs.de
> > Phone: +49 711 685 68039
> > 

	Mattias
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5032 bytes
Desc: not available
URL: <http://mailman.egi.eu/pipermail/gt-eos/attachments/20180525/77c1dbc0/attachment.p7s>