bugmonotone - Bugs: bug #16790, SSL for confidentiality (and...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #16790: SSL for confidentiality (and perhaps authentication)

Submitter:  None
Submitted:  Thu 08 Jun 2006 08:55:01 PM UTC
   
 
Category:  cryptography Severity:  3 - Normal
Item Group:  feature request Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open
mtn version --full: 

monotone 0.26 (base revision: 4342565107f26ceda955b66c66b5b7ec152f314e)
Running on          : Linux 2.6.16-1.2111_FC4 #1 Sat May 20 19:59:40 EDT 2006 i686
C++ compiler        : GNU C++ version 4.0.2 20051125 (Red Hat 4.0.2-8)
C++ standard library: GNU libstdc++ version 20051125
Boost version       : 1_32
Changes since base revision:
unknown

Jump to the original submission

Mon 19 Jun 2006 08:44:58 AM UTC, comment #10: 

(Finally bothered to get an account)

Jack Lloyd <randombit>
Group Member
Mon 19 Jun 2006 08:37:04 AM UTC, comment #9: 


Yes, you are certainly right about async sockets + SSL being a pain. I know OpenSSL has had in the past (and may still have) various very weird failure cases when running on async sockets, and oh-my-god are they painful to track down. Right now Ajisai doesn't support async sockets at all, not to mention a distinct lack of Windows socket support, etc - it works, but I would not suggest using it in anything approaching production software in its current state. I really should start working on it again, there has been a lot of interest from different quarters (KDE, especially) but I'm always either short on time or motivation.

I think I mentioned something about MITM very briefly at one point - the easiest (rather, simplest) way to deal with MITM in this context is to simply predistribute all the certs and avoid certificates chains/authorities entirely. Since this is exactly the current model, there is no real loss in usability. (Or shouldn't, at least). There is some extra stuff in a self-signed cert that isn't in the Monotone key format (a signature on itself and some places to put various pieces of metadata), but you could treat such a cert exactly like an email/key pair if you wanted.

Jack Lloyd <randombit>
Group Member
Sun 11 Jun 2006 07:52:31 PM UTC, comment #8: 

Oh, and re: the bug title -- you have to use the same system for both confidentiality and authentication, because otherwise your confidentiality is open to MITM attacks.

(Perhaps this is not that big a worry compared to having no confidentiality at all, but one might as well get these things right.)

Nathaniel Smith <njs>
Group Member
Sun 11 Jun 2006 07:48:52 PM UTC, comment #7: 

In principle I think we'd be happy to use SSL at the channel layer.  Having our own crypto there gives me the heebie-jeebies, too.  There are some reasons why this isn't what we did from the start, though:
  * OpenSSL is GPL-incompatible, so we can't use it.  (We could in principle relicense monotone to add an exception, but then we would be GPL-incompatible.  Since we currently distribute some GPLed and LGPLed code from third parties, and might want to do so in the future, and our code has itself been used in other projects, this option is unappealing.)  GnuTLS and Ajisai are both options.  The Ajisai faq says that it is still very alpha, though it's otherwise appealing (minimal new dependencies, presumably sane API, author has been responsive to our needs in the past).
  * Async sockets + SSL is a major pain in the butt.  It requires lots of magic, and last I checked there was no freely available documentation describing how to do it.
  * Most SSL code assumes you want to join in the X.509 mess -- e.g., you should have a key in that format sitting in a file, and you want to use signature chains to validate the other side, and so on.  It is probably possible to build an actually usable system out of these primitives -- i.e., one that doesn't add extra key distribution hassles or CAs, but still provides MITM protection -- but I couldn't figure out how to do it.

So, yeah.  SSL would be nice, there are just annoying practical issues to overcome.

(Who are you, by the way? :-))

Nathaniel Smith <njs>
Group Member
Fri 09 Jun 2006 01:02:08 AM UTC, comment #6: 


Sounds reasonable. I have yet to really dig into the code (though, BTW, from what I've seen it is excellent work, certainly better than my own C++), but maybe this is a good time to do so.

Anonymous
Fri 09 Jun 2006 12:35:21 AM UTC, comment #5: 

Yeah, SSH is mostly for private use. You can scale it up a bit if you put entries in your .ssh/authorized_keys file with a command restriction (similar to http://www.selenic.com/mercurial/wiki/index.cgi/SharedSSH) but it's not terribly satisfying, I'll admit.

The authentication layer of monotone is not terribly rich, and may need some further adjustment as time passes. Currently it calls hooks to confirm read/write accesses from the network, but it doesn't mention whether those accesses came over SSL (since it has no idea about SSL). Some extension could be possible there, certainly.

Key metadata has been pretty bad since the get-go. We're going to be having a go at cleaning this up when we do our "policy branch" work. This will involve storing some versionned policy settings in the database which describe human-to-machine identifier mappings, so you'll be able to rename and expire keys and branches, etc. That work hasn't really gotten underway yet though.

graydon hoare <graydon>
Group Member
Fri 09 Jun 2006 12:33:14 AM UTC, comment #4: 

(I have a feeling my first questions can be answered by reading the hook documentation. I will do so tonight)

Anonymous
Fri 09 Jun 2006 12:17:15 AM UTC, comment #3: 


Hrm. In general SSH is going to require that every user have an account on the machine, so I would say it addresses my initial problem while introducing one that I like even less. On the other hand the hooking mechanism may mean I can do this myself with some Lua glue and a little bit of C. I presume it is possible to allow anonymous pulls over netsync but require all pushes (and pulls from branches that have access controls) to happen over an alternate channel ie SSL? Also is there a way to short circuit Monotone's built in authentication mechanisms and so forth? I suppose I should go read the source now.

I can't say I'm really enthusiastic about it as a solution, but then again I'm not about to hack all of the nice stuff in Monotone into OpenCM, either, so I should probably just shut up and eat my damn lemons.

That does leave the key metadata thing unresolved, though. The docs make it sound like once a key is in the database with a particular email, it's impossible to introduce another key with the same email address. Am I wrong about this?

Anonymous
Thu 08 Jun 2006 09:30:55 PM UTC, comment #2: 

I should say "the soon-to-be-released 0.27", since there's no such release yet.

graydon hoare <graydon>
Group Member
Thu 08 Jun 2006 09:30:12 PM UTC, comment #1: 

0.27 can speak over ssh, with an ssh:// URI form as the "host" parameter of push/pull/sync. It is also extensible in lua scripts to use any other full duplex channel you can run as a subprocess. Good enough?


graydon hoare <graydon>
Group Member
Thu 08 Jun 2006 08:55:01 PM UTC, original submission:  


The one feature of OpenCM that I really miss in Monotone is the support for SSL communication (actually OpenCM always ran over SSL, but that isn't really relevent). Privacy is important for me (I have some things in Monotone I wouldn't want other people to see, such as proprietary code and my personal configs, and I often work from coffeeshops, etc). Also the fact that Monotone has a custom authentication protocol somewhat frightens me. I know you guys are smart, and I've looked at it and didn't see any problems, but this really does seem to be something where standard == good, because standard protocols are the only thing that the real security people spend a lot of time looking hard at, and at this point Monotone isn't popular enough to attract serious attention from that sphere.

Taking into account the obvious responses:

- It would require yet another dependency. I agree that isn't great. It would boil down to either switching from Botan to OpenSSL, or using Ajisai. Neither seems like a compelling choice.

- Someone has to do the work, and it should be me since I want this. Yeah, I know. I'm busy, as I'm sure you are. :/

- Stunnel / SSH tunneling: My feeling on this is the same as --daemonize; this is something which should just work. Stunnel is IMO a stopgap at best. If it is something that can be done automatically without extra work from the user, it should be done.

- Certificates are a mess. Obviously. However using self-signed certs with manual imports is basically the same thing the current raw key system, but provides an easy (standard, documented, already supported) way of binding metadata to the key (maybe it is just me, but having the email address be the index for a key seems like a bad idea - what if I want to have multiple keys? What if I lose my key? I haven't seen a good way of handling these cases...). And it does leave open interesting opportunities WRT project-specific CAs, key revocation, etc in the future, if someone wants to deal with that complexity later on.

I suppose there are two questions here, one is if it is a good idea (in principle) to use SSL+certs, another is who is actually going to do it. I don't have a good answer for the latter, but I think I can make a good case for the former. I'd be happy to discuss here or on the list if anyone wants to talk about it.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

 

No changes have been made to this item

Back to the top

Powered by Savane 3.13-cf05.
Corresponding source code