We also have our own tests and monitoring for padding oracles. You can see s2n's here: https://github.com/awslabs/s2n/blob/master/tests/unit/s2n_cbc_verify_test.c … , and re-running these checks would actually show no impact. Head-scratcher!
-
-
But that makes it more interesting! How do we find and prevent even these kind of rarefied cases? Automation, like the scanning tool, is clearly critical - but can we do more at the point of code?
Show this thread -
One thing I'm grateful for is that in s2n we kill connections on any error, and we do it in a way where s2n will completely refuse to interact with the connection after the error has happened. Just with a closed flag ... https://github.com/awslabs/s2n/blob/master/tls/s2n_connection.c#L1031 …
Show this thread -
s2n uses OpenSSL's libcrypto for the underlying cryptography, and the same issue in that code /could/ have caused impact within s2n were it not for that practice. Basically this check .... https://github.com/awslabs/s2n/blob/master/tls/s2n_send.c#L94 …
Show this thread -
Of course the impact still would have been small, because of the other factors, but I'm glad we have that check! Anyway, thanks again to the issue reporters, read their paper when it comes! and thanks for Andrew and Steven from the TLS team. That's it, unless AMA.
Show this thread -
New conversation -
-
-
actually you do not need clients which send 0-byte records. An Attacker can cut the record (adjust the iv) and adjust the length of the record header. This way a normal record appears to the server as zero length with an invalid mac, although the original record was way longer
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.