News for hackers. Stuff that matters.
Re:"OpenSSL has exploit mitigation countermeasures to make s... by EvanAnderson on Wednesday April 09, 2014 @06:52AM (#7558601)
This is the first that I've had time to actually sit down and look at code, the RFC, etc, and I'm scratching my head.

The rationale for the payload for DTLS (sent over UDP) is reasonable, but I'm scratching my head over why the payload is even there for TLS. I guess there's some logic in making the protocol the same irrespective of underlying transport, but the payload is completely redundant for reliable protocols, which will handle any retransmission or reordering automatically.

Edit: Upon further (amateur and arguably ill-informed) reflection I'd argue that the heartbeat functionality shouldn't apply to TLS at all. It's needless complexity that can be handled by the underlying reliable transport. That doesn't change that the OpenSSL project clearly has code-quality issues, but it would have averted this particular fiasco, at least.

I am dismayed that a security-oriented protocol isn't focused on minimalast design. That seems very backward to me.

Re:"OpenSSL has exploit mitigation countermeasures to make s... by noselasd on Wednesday April 09, 2014 @09:13AM (#7559021)
If you ever implement connection oriented protocols, you will very quickly find the need for a heartbeat mechanism - otherwise you have no way of telling whether the remote end is dead, or if is just busy creating data for you/doesn't have any data for you right now.

Not having heartbeats, you end up relying only on arbitrary timers to time out your connections, which are far from optimal, or you end up relying only on the underlying protocol which is not enough in most cases.

TCP doesn't provide that for you. (TCP does provide keepalives, intended for other means, they might be a poor mans substitute, but they arn't exposed to the TCP user in a particularly useful way - it's also the wrong layer for this problem)

Re:"OpenSSL has exploit mitigation countermeasures to make s... by rst on Wednesday April 09, 2014 @11:15AM (#7559767)
TCP heartbeats certainly will let you know if the remote end is entirely dead.

They won't let you know if the application process is jammed up --- but TLS hearbeats won't do that for you either! (For example, it's common to have the crypto handled by front-end processes, with the application logic elsewhere.) So if that's what you want, then you need heartbeats at the application layer, not in TLS.

Given all that, the case for hearbeats at the TLS layer for TLS over TCP seems ... weak. Particularly since simply having them there violates the commonly cited best practice that security kernels should be kept small. And this violation has already had disastrous consequences.

Besides, for all the times I see people making this argument, I've yet to see them cite an example of a real problem in a real world deployment for which TLS hearbeats were used, and turned out to be the best solution.

Re:"OpenSSL has exploit mitigation countermeasures to make s... by EvanAnderson on Wednesday April 09, 2014 @09:32AM (#7559121)
I'm familiar with the paradigm. I've written some code to talk to dodgy embedded devices that don't "talk" unless they have something to say and I have ended up having to use timers. It sucks, to be sure.

I looked back to RFC1122 to get a feel for the nature of TCP keepalives, and I would agree that they're unsuitable for this application.

If we posit that a keepalive mechanism is useful for TLS I'd still argue that a payload is unnecessary because TCP will handle in-order delivery. A NOOP with some random-length padding would have worked just as well.

Re:"OpenSSL has exploit mitigation countermeasures to make s... by caf on Wednesday April 09, 2014 @08:01AM (#7558766)
It's easy to see why, without the benefit of hindsight, one might think that the minimal approach was to have the same extensions apply to both DTLS and TLS.
Re:"OpenSSL has exploit mitigation countermeasures to make s... by EvanAnderson on Wednesday April 09, 2014 @08:29AM (#7558858)
I don't know where to go look (mailing list archives? meeting minutes?) to find any discussion about this extension (I'm woefully ignorant of Internet standards processes), but it would certainly be nice to review that discussion.

Given the rather dramatic differences that need to occur in a protocol designed to work over unreliable versus reliable transport, though, it seems like a bad idea to try to keep "parity" between DTLS and TLS. I can see how somebody might see it as "elegant" to do so, but I'd argue they're different animals solving different problems.

Re:"OpenSSL has exploit mitigation countermeasures to make s... by ralfd on Wednesday April 09, 2014 @11:00AM (#7559688)
Maybe the payload is used for a sequential id number?