I plan to submit the following text for packaging guidelines regarding crypto policies. Are there any comments or suggestions?

Hello, I plan to submit the following text for packaging guidelines regarding crypto policies. Are there any comments or suggestions? Since Fedora 21 (http://fedoraproject.org/wiki/Changes/CryptoPolicy) there are policies for the usage of SSL and TLS cryptographic protocols that are enforced system-wide. Each application being added in Fedora must be checked to comply with the policies. Currently the policies are restricted to applications using GnuTLS and OpenSSL. * OpenSSL applications: If the application provides a configuration file that allows to modify the cipher list string, ensure that the default is "PROFILE=SYSTEM". Otherwise, if the application doesn't have a configuration file, ensure that there is no default cipher list specified, or that the default list is set as "PROFILE=SYSTEM". * GnuTLS applications: If the application provides a configuration file that allows to modify the cipher priority string, ensure that the default is "@SYSTEM". Otherwise, if the application doesn't have a configuration file, ensure that it uses gnutls_set_default_priority(), or that the default priority string is "@SYSTEM". Applications utilizing other cryptographic libraries do not adhere to the system wide crypto policies. regards, Nikos -- security mailing list security(a)lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/security

Hello, I plan to submit the following text for packaging guidelines regarding crypto policies. Are there any comments or suggestions?

-----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQGcBAEBCgAGBQJT5MsZAAoJEB/kgVGp2CYveDcL/3ZDrb5OcDlYOfzIrqvymdE2 AMfLc8qAgYsLnD+h09t5LxPEwXIopkKEamIrnn/eBhqOcX9z5suM7AKLo374Rzz5 lL36Lb3uz6HiAxxNEs5WkHAZ4slo8rwfkAEla7wZsgTtY+VU5Yc3LEptFIzogFa8 Dep0sTPZ8zC52UpITowq2Uh6FAmGTAQivDlvtjy1HZWvVZbAn9OY8J4SCXTvJCzp a6V+O0fDGmo0kiGLG7TbyryRnz5EZFL/V7xZpZR2kyLPmbsOndE5pEHw19cbOA1+ 18DKiKaCNl6nxRJLkfN4Ld3rt3Yy2bJ/5g1aBxzPn06fO/exj0W7v3r+YrR6sFpH pxoudB6bajukCBJTnzFj1R2S35lkZRXumEWoUCdBwb23/Q5Rw4UCdcANkCsoaskI IrCP52YrHQmB3UNl2GWjXCjye+fyW0ja5H9oeIWDXc1EF+ikhZH/i1ePPGjCN5YK 3V4FPlzB8bzv+HaThyATvcHHn3xhx+oc07zUq+tAdw== =98/j -----END PGP SIGNATURE-----

Postfix is a different kind of beast though. It does not typically use TLS, but uses some kind of opportunistic security that allows anonymous ciphersuites. So it's a bit hard to enforce anything there, as man-in-the-middle attacks are possible by design

From: "Eric H. Christensen" <sparks(a)fedoraproject.org&gt; To: "Reindl Harald" <h.reindl(a)thelounge.net&gt; Cc: security(a)lists.fedoraproject.org Sent: Friday, 8 August, 2014 3:44:40 PM Subject: Re: proposed text for crypto-policies in Packaging Guidelines -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 On Fri, Aug 08, 2014 at 03:36:51PM +0200, Reindl Harald wrote: > > Am 08.08.2014 um 15:21 schrieb Nikos Mavrogiannopoulos: > > Postfix is a different kind of beast though. It does not typically use > > TLS, but uses some kind of opportunistic security that allows anonymous > > ciphersuites. So it's a bit hard to enforce anything there, as > > man-in-the-middle attacks are possible by design > > and keep in mind in case of opportunistic TLS if you restrict > ciphers and the SMTP client don't support what you offer it > falls back to completly plaintext which defeats the intention Falling back to an insecure cipher only provides a false sense of security which isn't any better than plaintext.

Am 08.08.2014 um 15:44 schrieb Eric H. Christensen: > On Fri, Aug 08, 2014 at 03:36:51PM +0200, Reindl Harald wrote: >> Am 08.08.2014 um 15:21 schrieb Nikos Mavrogiannopoulos: >>> Postfix is a different kind of beast though. It does not typically use >>> TLS, but uses some kind of opportunistic security that allows anonymous >>> ciphersuites. So it's a bit hard to enforce anything there, as >>> man-in-the-middle attacks are possible by design > >> and keep in mind in case of opportunistic TLS if you restrict >> ciphers and the SMTP client don't support what you offer it >> falls back to completly plaintext which defeats the intention > > Falling back to an insecure cipher only provides a false sense of security > which isn't any better than plaintext. you *can not* enforce ciphers for opportunistic TLS - period because that is the nature of *opportunistic*

-----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQGcBAEBCgAGBQJT5N7mAAoJEB/kgVGp2CYvFB4L/j6bNlGgY12T/cTwNFMldd6v 5Zj4THpxKmKg/Mp08Q21XAucZJIL0nkaNBCaidJKkjH+h/jwq02nZ500/a9m/spJ QbSt1oRX47weFs/VX3mv1RPL8xIGxhJUmmhJRFPMdiwo+sEX2koiLyKRnbmt9CYM rkh2tihNV3XEScY0N8xxZBtU0dv586ceDzfmnP502mmpnIBsPupZCTbSlpZiNfmC AJNITgNqmb7bzjw/MFyrmHr0oq6ve/3bs5pAn0NZRahubhKtNeMQMuZosDLFyekW 5+dVbTFTSPx8dhl7lcGK9W2zCStcrjeNLyX0ypzgQy6Lx9/QOnLl/HasiP5KS1C5 kVEzOuWPCb5KH+UeToylq9ISoC+85oRRL+tNHdbAd+ZhT88tnYI0lNbd5A4wPoAs 6rxsf3Xnh3YRDrZPVf1KYGUV5CExMc0ff3livfjp/xvhq0ZcjC+lyYM5yAoUSWUX tBX9HldTipHgWJ2FCMvzdl1pj9/I+7hoUuHqBBtW6g== =b7I4 -----END PGP SIGNATURE-----

From: "Reindl Harald" <h.reindl(a)thelounge.net&gt; To: security(a)lists.fedoraproject.org Sent: Friday, 8 August, 2014 4:45:02 PM Subject: Re: proposed text for crypto-policies in Packaging Guidelines Am 08.08.2014 um 16:30 schrieb Eric H. Christensen: > On Fri, Aug 08, 2014 at 04:11:51PM +0200, Reindl Harald wrote: >> Am 08.08.2014 um 15:44 schrieb Eric H. Christensen: >>> On Fri, Aug 08, 2014 at 03:36:51PM +0200, Reindl Harald wrote: >>>> Am 08.08.2014 um 15:21 schrieb Nikos Mavrogiannopoulos: >>>>> Postfix is a different kind of beast though. It does not typically use >>>>> TLS, but uses some kind of opportunistic security that allows anonymous >>>>> ciphersuites. So it's a bit hard to enforce anything there, as >>>>> man-in-the-middle attacks are possible by design >>> >>>> and keep in mind in case of opportunistic TLS if you restrict >>>> ciphers and the SMTP client don't support what you offer it >>>> falls back to completly plaintext which defeats the intention >>> >>> Falling back to an insecure cipher only provides a false sense of >>> security >>> which isn't any better than plaintext. > >> you *can not* enforce ciphers for opportunistic TLS - period >> because that is the nature of *opportunistic* > > I agree with your assessment, however, ordering the ciphers that are to be > used can still be done agreed, with caution below, that is still an issue and 64 is sadly exceeded with defaults and in future versions of openssl that will grow (new cipher types) [harry@srv-rhsoft:~]$ openssl ciphers -v | wc -l 75 71: RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 http://www.ietf.org/mail-archive/web/tls/current/msg10554.html The Windows 2003 TLS stack (still used by a non-trivial number of Microsoft Exchange SMTP servers) only looks at the first 64 elements of the cipherlist. If neither RC4-SHA nor RC4-MD5 are among these,