Re: [TLS] The risk of misconfiguration

[Viktor Dukhovni <[e-mail]>]

On Tue, May 06, 2014 at 06:08:52PM -0700, Watson Ladd wrote:

> > We must not confuse implementation user-interface issues with
> > protocol issues.  The protocol supports many different use-cases.
> > Interfaces for cipher selection in implementations are not protocol
> > issues.  The OpenSSL cipherlist interface is beginning to get some
> > attention.  That issue belongs on [e-mail], not
> > [e-mail].
> 
> Agreed, but it's an example of the hazard that insecure modes present.

> No matter how the choice is presented to end-users or application
> developers, so long as it is possible to misconfigure TLS, it will be
> misconfigured.

In Postfix the user chooses a "cipher-grade" that sets the floor
on the set of enabled cipher-suites.  The levels are monotone.
This is a simple interface that is rather difficult to mess up.

The underlying definitions of these grades is also configurable,
but I strongly discourage users from attempting to touch these
without expert advice.

This has worked well for nearly a decade with no evidence of
significant user confusion or misguided misconfiguration.

User interfaces need to make the simple things easy and the
complicated things possible.

> You can blame the end user or the programmer or the
> library writer all you want, but unless a library is willing to forgo
> supporting null ciphers, they will be used inadvertently. Why include
> something that should virtually never be used, when using it has bad
> consequences?

The above is just a rhetorical rant.  Risk cannot be banned out of
existence, but systems can be designed with greater safety in mind.

> We've recognized the need for guidance on how to use TLS, hence
> formation of UTA.  We're punting on implementation, although I recently
> got an email about the C standards body wanting to standardize APIs
> for networks, which, if they included TLS with a sane API would be
> wonderful. But the complexity that OpenSSL reveals is real: there is
> no way to support all possible combinations of ciphersuites without
> something this nasty to pick between them.

The above is plainly false.  Good systems offer many layers of
controls, some for naive users some for experts.  They have high
and low level APIs, with the latter offering more fine-grained
control when needed.  OpenSSL should be improved not neutered.

Software that only dumbs everything down is not progress, we need
software that is both usable and flexible.

-- 
	Viktor.