You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2022/08/03 01:28:07 UTC

[Bug 66199] New: RFC 9266: Channel Bindings for TLS 1.3 support

https://bz.apache.org/bugzilla/show_bug.cgi?id=66199

            Bug ID: 66199
           Summary: RFC 9266: Channel Bindings for TLS 1.3 support
           Product: Apache httpd-2
           Version: 2.5-HEAD
          Hardware: All
                OS: All
            Status: NEW
          Severity: blocker
          Priority: P2
         Component: mod_ssl
          Assignee: bugs@httpd.apache.org
          Reporter: Neustradamus@hotmail.com
  Target Milestone: ---

Can you add the support of RFC 9266: Channel Bindings for TLS 1.3?
- https://datatracker.ietf.org/doc/html/rfc9266

Little details, to know easily:
- tls-unique for TLS =< 1.2
- tls-exporter for TLS = 1.3

Thanks in advance.

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 66199] RFC 9266: Channel Bindings for TLS 1.3 support

Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=66199

--- Comment #3 from Neustradamus <Ne...@hotmail.com> ---
@jorton: Thanks for your reply!

tls-exporter is missing, the RFC9266 is to add Channel Binding to TLS 1.3 and
has been released few days ago.

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 66199] RFC 9266: Channel Bindings for TLS 1.3 support

Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=66199

--- Comment #5 from Neustradamus <Ne...@hotmail.com> ---
Dear Apache Team,

Have you progressed for tls-exporter?

Thanks in advance.

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 66199] RFC 9266: Channel Bindings for TLS 1.3 support

Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=66199

Neustradamus <Ne...@hotmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |Neustradamus@hotmail.com

--- Comment #4 from Neustradamus <Ne...@hotmail.com> ---
I think that you have seen the jabber.ru MITM and Channel Binding is the
solution:
- https://notes.valdikss.org.ru/jabber.ru-mitm/
- https://snikket.org/blog/on-the-jabber-ru-mitm/
- https://www.devever.net/~hl/xmpp-incident
- https://blog.jmp.chat/b/certwatch

Little details, to know easily:
- tls-unique for TLS =< 1.2
- tls-server-end-point
- tls-exporter for TLS = 1.3

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 66199] RFC 9266: Channel Bindings for TLS 1.3 support

Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=66199

--- Comment #2 from Joe Orton <jo...@redhat.com> ---
r1620926 and r1620927 in fact.

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 66199] RFC 9266: Channel Bindings for TLS 1.3 support

Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=66199

--- Comment #1 from Joe Orton <jo...@redhat.com> ---
The TLSv1.2 support exists in trunk (see r1620926) though I'm not sure if there
were ever any consumers for this API.

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 66199] RFC 9266: Channel Bindings for TLS 1.3 support

Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=66199

Eric Covener <co...@gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Severity|blocker                     |enhancement

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org