.png)
The OpenSSL project released version 4.1.0, adding support for DTLS 1.3 and listing four known bugs in the DTLS code that ships with it. DTLS is the variant of TLS built for datagram transports such as UDP, and version 1.3 is defined in RFC 9147.
The bugs fall on developers who adopt DTLS 1.3 or the DTLS support newly added to OpenSSL’s SSL listener API. Two of them can make an application misread a connection’s state. A permanent receive failure on a DTLS listener can surface as SSL_ERROR_WANT_READ, the code that tells a program to wait for more data, and polling and later accept calls may miss the error too, leaving the application waiting on a dead connection. A retryable write failure on a nonblocking accepted connection can surface as SSL_ERROR_SYSCALL, and an application that treats that code as fatal may close a connection that still works.
Handshakes and tickets can go missing
A DTLS 1.3 server may abort a handshake with an unexpected_message alert when the client acknowledges part or all of the server’s first flight before replying. That can happen after packet loss.
The fourth bug involves KeyUpdate, the message a peer sends to switch to fresh encryption keys mid-session. When OpenSSL receives one, it drops all other outstanding post-handshake records from its retransmission buffer. If a NewSessionTicket, which lets a client resume the session later, was lost on its first trip, OpenSSL will not send it again. The project has a fix in progress for this bug and lists no fix status for the other three, so if you run a DTLS 1.3 server, plan around all four.
Build flags that did not do their job
OpenSSL also removed the no-ecdsa and no-ecdh options from Configure because they did not really disable the implementations they named. A build configured with either flag still carried the code it was meant to leave out. The project points users to no-ec, which disables elliptic curve support entirely.
Two other changes can break existing setups. OpenSSL dropped the Windows-on-Itanium and Windows CE build targets, and the tsget time-stamping utility now requires the Perl module Net::Curl::Easy, replacing the abandoned WWW::Curl::Easy. Anyone who relies on tsget should install the new module before upgrading.
Faster post-quantum math
ML-KEM and ML-DSA, the post-quantum key exchange and signature algorithms, get optimized NTT operations on ppc64le, and ML-DSA gets further x86_64 work that includes AVX-512 SHAKE x4 code. AES-CBC decryption on x86_64 picks up AVX-512 and VAES optimizations. The release also adds RFC 8701 GREASE, which sends random reserved values in handshakes to flush out servers that mishandle values they do not recognize, along with an IKEv2 key derivation function and initial support for the Elbrus2000 architecture.
The DTLS 1.3 guide ships as the ossl-guide-dtlsv13(7) manual page. Code that accepts connections from a DTLS listener should not take SSL_ERROR_WANT_READ or SSL_ERROR_SYSCALL at face value until OpenSSL fixes those two bugs.
Must read:
Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!
from Help Net Security https://ift.tt/Iq20TDW
0 comments:
Post a Comment