12 ms·

Chrome: From NSS to OpenSSL

128 points by moonboots 12y ago

higherpurpose 12y ago
Can't they use Sodium instead? http://labs.umbrella.com/2013/03/06/announcing-sodium-a-new-cryptographic-library/ http://labs.umbrella.com/2013/03/06/announcing-sodium-a-new-...
- harshreality 12y ago
  Sodium does not implement TLS.
- tptacek 12y ago
  No. Not only is Sodium (more accurately: NaCl) not a TLS library, but it doesn't even implement the primitives that TLS needs; it can't really even serve as a component of another TLS library.
  - tekacs 12y ago
    Not that you're not absolutely right about NaCl & Sodium, but isn't the GP talking explicitly about Sodium and not NaCl? When you say 'more accurately: NaCl', is there something particular you're getting at, or are you speaking from experience of NaCl rather than Sodium (or are you talking about the fact that the bindings seem to be named/built for the original NaCl?) Edit: or do you just think it's still better to call it NaCl given that it's a fork of, or I suppose a refined implementation of NaCl?
    - alextgordon 12y ago
      Any SSL implementation worth its salt needs to implement historical primitives like RC4 and MD5. libsodium will not and should not implement these because they conflict with the goal of providing an idiot-proof crypto library.
      - tekacs 12y ago
        This has nothing to do with what I asked. Also, this I know. Sorry? :P
      - spoiler 12y ago
        Isn't it better to not include stuff that's insecure, even if they have historic value? Isn't this a big part of the problem of some (even OpenSSL) software?
    - aryastark 12y ago
      it's more accurate to discuss NaCl since that's what libsodium is. NaCl is the combination of crypto primitives and the "box" abstraction. libsodium is just the repackaging and clean-up of the original NaCl implementation. If you're discussing crypto, you're going to be looking at the papers on NaCl.
      - tekacs 12y ago
        Mm that's roughly the impression I got, but I hadn't thought of the papers - thanks for the clarification!
majke 12y ago
And here is compulsory email thread explaining some context: https://groups.google.com/forum/?_escaped_fragment_=msg/mozilla.dev.tech.crypto/4F3z644W8BM/aUq9UBh7rNYJ#!msg/mozilla.dev.tech.crypto/4F3z644W8BM/aUq9UBh7rNYJ https://groups.google.com/forum/?_escaped_fragment_=msg/mozi... > Strange that "PKCS#11 support" is listed as a "con" for NSS > It was not accidental that it was listed under "Con", nor do I see ENGINE_pkcs11 as a "Pro"
- ewindisch 12y ago
  This conversation circles back to Theo de Raadt's argument that developers are caring too much about performance in security-critical applications.
  - pfortuny 12y ago
    Which is the typical point in which Theo de Raadt is right even though he may be saying so quite singularly. This is another instance of the lack of 'engineering' in Computer Science/Programming/you name it. Engineers have long ago learnt that you need "automatic" standards and compliance before, during and after building anything, and that the best practice is always assuming thing will go wrong. This, unfortunately, is not the case with programming as we can see time and again. But I digress.
- mike_hearn 12y ago
  Smartcard support is pretty important for a lot of people. If Chrome drops that feature, that would be a huge shame.
  - nvdk 12y ago
    every belgian citizen is issued a pkcs e-id, not supporting it means they all need another browser to do their taxes and log in to healthcare websites...
sgarlatm 12y ago
It may actually be a good thing if Chrome migrates to OpenSSL. With their resources, perhaps they can do some testing to see if there are any more vulnerabilities out there. At the very least, their continued eye on the project should help it be more secure going forward.
- crashandburn4 12y ago
  Those were my thoughts exactly, I think OpenSSL just needs a bit of care and refactoring (possibly a lot depending on which blogs you read) for which they need devs and resources, both of which google has.
  - thirsteh 12y ago
    The problem with OpenSSL is that it's really problematic to simply fix and refactor stuff given their FIPS certification.
    - leoc 12y ago
      Ooh, OpenSSL's FIPS certification. The fellows who've been fighting for years to take it away http://www.itnews.com.au/News/65016,openssl-in-a-fips-flap.aspx http://www.itnews.com.au/News/65016,openssl-in-a-fips-flap.a... must be crowing right now. (Regardless of whether their own stuff is any better or no.) Another decertification incoming?
      - crashandburn4 12y ago
        Hi, can someone help me understand what the significance of FIPS certification is? ( beyond the wikipedia page: http://en.wikipedia.org/wiki/FIPS_140-2 http://en.wikipedia.org/wiki/FIPS_140-2 )
        leoc 12y ago
        AFAIK the US federal government (excluding the military, which obviously has its own hoops to jump through) generally can't use your hardware/software unless it has the appropriate FIPS certification(s). https://en.wikipedia.org/wiki/Federal_Information_Processing_Standards https://en.wikipedia.org/wiki/Federal_Information_Processing...
thrillgore 12y ago
Unless Google is going to clean OpenSSL up along the way, I don't see any immediate benefit.
- JosephRedfern 12y ago
  AFAIK Heartbleed was found during one of Googles code-reviews of OpenSSL.
edwintorok 12y ago
On Debian Chromium 33.0.1750.152-1 seems to be using GnuTLS, I didn't know that the official Chrome used NSS: $ ldd /usr/lib/chromium/chromium|grep -E tls\|ssl libgnutls.so.28 => /usr/lib/x86_64-linux-gnu/libgnutls.so.28 (0x00007fbae0878000) In fact on Debian most client software is using either NSS or GnuTLS, OpenSSL is more popular server-side of course.
- dtech 12y ago
  Due to (mostly ideological) licensing incompatibilities some package maintainers and/or distributions link software with GnuTLS instead op OpenSSL. GnuTLS provides a basic compatibility layer with OpenSSL. So Chromium may in fact be programmed against OpenSSL but might work when linked to GnuTLS
fabian2k 12y ago
I found the following part in the cons to NSS amusing, or maybe rather frightening: > Certificate path building is C code designed to emulate Java code, through indirection of an average of 7 layers of macros, two platform abstraction layers, and then the remaining NSS abstraction layers (listed above)
- joshmoz 12y ago
  IIRC... That is in reference to libpkix, the certificate validation component of NSS. I believe Mozilla developers are working on a replacement for it, called mozilla::pkix, in large part due to libpkix being overly complex. Last time I checked mozilla::pkix was pretty far along. https://bugzilla.mozilla.org/show_bug.cgi?id=915930 https://bugzilla.mozilla.org/show_bug.cgi?id=915930
  - handsomeransoms 12y ago
    It landed on Nightly a week ago, check it out! You can help us by testing it [0] or reviewing the code [1]. [0] https://wiki.mozilla.org/SecurityEngineering/mozpkix-testing#Request_for_Testing https://wiki.mozilla.org/SecurityEngineering/mozpkix-testing... [1] https://wiki.mozilla.org/SecurityEngineering/mozpkix-testing#Request_for_Code_Review https://wiki.mozilla.org/SecurityEngineering/mozpkix-testing...
  - cvc 12y ago
    To be even more precise, this new certificate validation library is the current default in nightly (ff-31), testing is welcome.
- kaiengert 12y ago
  Note that NSS contains a classic certificate verification engine, which was originally written in C. The above statement refers to an external contribution that was added to NSS. It added a second validation engine to NSS, libpkix. It's true that the libpkix portion is very complicated code, but the above statement doesn't apply to NSS in general.
gioele 12y ago
Serious question: why is GnuTLS very often not considered as an alternative to OpenSSL?
- leccine 12y ago
  One but really important reason: https://gitorious.org/gnutls/gnutls/source/39aaa63a1a4cb8432e090887f38241afb2b264a6:COPYING https://gitorious.org/gnutls/gnutls/source/39aaa63a1a4cb8432... vs. http://www.openssl.org/source/license.html http://www.openssl.org/source/license.html
  - runeks 12y ago
    Also, it uses `strlen` and `strcat` on binary data: http://www.openldap.org/lists/openldap-devel/200802/msg00072.html http://www.openldap.org/lists/openldap-devel/200802/msg00072...
  - gioele 12y ago
    GnuTLS is LGPL 2.1+: https://gitorious.org/gnutls/gnutls/source/39aaa63a1a4cb8432e090887f38241afb2b264a6:README#L103-107 https://gitorious.org/gnutls/gnutls/source/39aaa63a1a4cb8432... not GPL 3 as that file seems to imply
tptacek 12y ago
Though Ryan disagrees strongly, I think this is unfortunate. I think a case can be straightforwardly made that NSS is the better library. Here's a shotgun blast of reasons: * NSS has more institutional constraints; random people in Germany can't, as a general rule, add support for new TLS extensions to it. * NSS has a clearer identity, as the TLS core for Firefox and Chromium. OpenSSL is a grab bag with hundreds of different stakeholders. * The most important code in both NSS and OpenSSL is the SSL state machine. The code for that state machine is incontrovertibly clearer and better expressed in NSS. * NSS has had better battle-testing as a clientside browser TLS library than OpenSSL, which, apart from Android Chrome, isn't a big factor in TLS clientsides. I don't know that anybody loves NSS, but my perception is that more people believe OpenSSL to be hopeless than believe NSS to be. Talking to Brian and Ryan on Twitter yesterday, I proposed that someone generate a list of questions to ask of a TLS codebase --- "what's the code path from first ClientHello to validating the public key signature in a certificate", or, "what's the code that determines which extensions are enabled" --- and we'd take a shot at answering them for NSS, SecureTransport, and OpenSSL. My bet is that the answers to those questions will be more favorable for NSS, even with the crappy certificate handling. Maybe a fork of NSS would be a better plan. However, to head off the drama HN is probably looking for here: one inevitable result of Google transitioning fully to OpenSSL is that OpenSSL will get a lot better, probably quickly.
- deleted 12y ago
  [deleted]
  - deleted 12y ago
    [deleted]
  - Wohui 12y ago
    When the ratio of comments to article-upvotes reaches a certain point, threads are punished as 'flamewars'.
    - deleted 12y ago
      [deleted]
    - 12y ago
codewiz 12y ago
The doc mentions this among the cons of NSS: "Certificate path building is C code designed to emulate Java code, through indirection of an average of 7 layers of macros, two platform abstraction layers, and then the remaining NSS abstraction layers (listed above)".
deleted 12y ago
[deleted]

128 points by moonboots 12y ago

Can't they use Sodium instead? http://labs.umbrella.com/2013/03/06/announcing-sodium-a-new-cryptographic-library/ http://labs.umbrella.com/2013/03/06/announcing-sodium-a-new-...

harshreality 12y ago
Sodium does not implement TLS.
tptacek 12y ago
No. Not only is Sodium (more accurately: NaCl) not a TLS library, but it doesn't even implement the primitives that TLS needs; it can't really even serve as a component of another TLS library.
- tekacs 12y ago
  Not that you're not absolutely right about NaCl & Sodium, but isn't the GP talking explicitly about Sodium and not NaCl? When you say 'more accurately: NaCl', is there something particular you're getting at, or are you speaking from experience of NaCl rather than Sodium (or are you talking about the fact that the bindings seem to be named/built for the original NaCl?) Edit: or do you just think it's still better to call it NaCl given that it's a fork of, or I suppose a refined implementation of NaCl?
  - alextgordon 12y ago
    Any SSL implementation worth its salt needs to implement historical primitives like RC4 and MD5. libsodium will not and should not implement these because they conflict with the goal of providing an idiot-proof crypto library.
    - tekacs 12y ago
      This has nothing to do with what I asked. Also, this I know. Sorry? :P
    - spoiler 12y ago
      Isn't it better to not include stuff that's insecure, even if they have historic value? Isn't this a big part of the problem of some (even OpenSSL) software?
  - aryastark 12y ago
    it's more accurate to discuss NaCl since that's what libsodium is. NaCl is the combination of crypto primitives and the "box" abstraction. libsodium is just the repackaging and clean-up of the original NaCl implementation. If you're discussing crypto, you're going to be looking at the papers on NaCl.
    - tekacs 12y ago
      Mm that's roughly the impression I got, but I hadn't thought of the papers - thanks for the clarification!

majke 12y ago

And here is compulsory email thread explaining some context: https://groups.google.com/forum/?_escaped_fragment_=msg/mozilla.dev.tech.crypto/4F3z644W8BM/aUq9UBh7rNYJ#!msg/mozilla.dev.tech.crypto/4F3z644W8BM/aUq9UBh7rNYJ https://groups.google.com/forum/?_escaped_fragment_=msg/mozi... > Strange that "PKCS#11 support" is listed as a "con" for NSS > It was not accidental that it was listed under "Con", nor do I see ENGINE_pkcs11 as a "Pro"

ewindisch 12y ago
This conversation circles back to Theo de Raadt's argument that developers are caring too much about performance in security-critical applications.
- pfortuny 12y ago
  Which is the typical point in which Theo de Raadt is right even though he may be saying so quite singularly. This is another instance of the lack of 'engineering' in Computer Science/Programming/you name it. Engineers have long ago learnt that you need "automatic" standards and compliance before, during and after building anything, and that the best practice is always assuming thing will go wrong. This, unfortunately, is not the case with programming as we can see time and again. But I digress.
mike_hearn 12y ago
Smartcard support is pretty important for a lot of people. If Chrome drops that feature, that would be a huge shame.
- nvdk 12y ago
  every belgian citizen is issued a pkcs e-id, not supporting it means they all need another browser to do their taxes and log in to healthcare websites...

sgarlatm 12y ago

It may actually be a good thing if Chrome migrates to OpenSSL. With their resources, perhaps they can do some testing to see if there are any more vulnerabilities out there. At the very least, their continued eye on the project should help it be more secure going forward.

crashandburn4 12y ago
Those were my thoughts exactly, I think OpenSSL just needs a bit of care and refactoring (possibly a lot depending on which blogs you read) for which they need devs and resources, both of which google has.
- thirsteh 12y ago
  The problem with OpenSSL is that it's really problematic to simply fix and refactor stuff given their FIPS certification.
  - leoc 12y ago
    Ooh, OpenSSL's FIPS certification. The fellows who've been fighting for years to take it away http://www.itnews.com.au/News/65016,openssl-in-a-fips-flap.aspx http://www.itnews.com.au/News/65016,openssl-in-a-fips-flap.a... must be crowing right now. (Regardless of whether their own stuff is any better or no.) Another decertification incoming?
    - crashandburn4 12y ago
      Hi, can someone help me understand what the significance of FIPS certification is? ( beyond the wikipedia page: http://en.wikipedia.org/wiki/FIPS_140-2 http://en.wikipedia.org/wiki/FIPS_140-2 )
      - leoc 12y ago
        AFAIK the US federal government (excluding the military, which obviously has its own hoops to jump through) generally can't use your hardware/software unless it has the appropriate FIPS certification(s). https://en.wikipedia.org/wiki/Federal_Information_Processing_Standards https://en.wikipedia.org/wiki/Federal_Information_Processing...

thrillgore 12y ago

Unless Google is going to clean OpenSSL up along the way, I don't see any immediate benefit.

JosephRedfern 12y ago
AFAIK Heartbleed was found during one of Googles code-reviews of OpenSSL.

edwintorok 12y ago

On Debian Chromium 33.0.1750.152-1 seems to be using GnuTLS, I didn't know that the official Chrome used NSS: $ ldd /usr/lib/chromium/chromium|grep -E tls\|ssl libgnutls.so.28 => /usr/lib/x86_64-linux-gnu/libgnutls.so.28 (0x00007fbae0878000) In fact on Debian most client software is using either NSS or GnuTLS, OpenSSL is more popular server-side of course.

dtech 12y ago
Due to (mostly ideological) licensing incompatibilities some package maintainers and/or distributions link software with GnuTLS instead op OpenSSL. GnuTLS provides a basic compatibility layer with OpenSSL. So Chromium may in fact be programmed against OpenSSL but might work when linked to GnuTLS

fabian2k 12y ago

I found the following part in the cons to NSS amusing, or maybe rather frightening: > Certificate path building is C code designed to emulate Java code, through indirection of an average of 7 layers of macros, two platform abstraction layers, and then the remaining NSS abstraction layers (listed above)

joshmoz 12y ago
IIRC... That is in reference to libpkix, the certificate validation component of NSS. I believe Mozilla developers are working on a replacement for it, called mozilla::pkix, in large part due to libpkix being overly complex. Last time I checked mozilla::pkix was pretty far along. https://bugzilla.mozilla.org/show_bug.cgi?id=915930 https://bugzilla.mozilla.org/show_bug.cgi?id=915930
- handsomeransoms 12y ago
  It landed on Nightly a week ago, check it out! You can help us by testing it [0] or reviewing the code [1]. [0] https://wiki.mozilla.org/SecurityEngineering/mozpkix-testing#Request_for_Testing https://wiki.mozilla.org/SecurityEngineering/mozpkix-testing... [1] https://wiki.mozilla.org/SecurityEngineering/mozpkix-testing#Request_for_Code_Review https://wiki.mozilla.org/SecurityEngineering/mozpkix-testing...
- cvc 12y ago
  To be even more precise, this new certificate validation library is the current default in nightly (ff-31), testing is welcome.
kaiengert 12y ago
Note that NSS contains a classic certificate verification engine, which was originally written in C. The above statement refers to an external contribution that was added to NSS. It added a second validation engine to NSS, libpkix. It's true that the libpkix portion is very complicated code, but the above statement doesn't apply to NSS in general.

gioele 12y ago

Serious question: why is GnuTLS very often not considered as an alternative to OpenSSL?

leccine 12y ago
One but really important reason: https://gitorious.org/gnutls/gnutls/source/39aaa63a1a4cb8432e090887f38241afb2b264a6:COPYING https://gitorious.org/gnutls/gnutls/source/39aaa63a1a4cb8432... vs. http://www.openssl.org/source/license.html http://www.openssl.org/source/license.html
- runeks 12y ago
  Also, it uses `strlen` and `strcat` on binary data: http://www.openldap.org/lists/openldap-devel/200802/msg00072.html http://www.openldap.org/lists/openldap-devel/200802/msg00072...
- gioele 12y ago
  GnuTLS is LGPL 2.1+: https://gitorious.org/gnutls/gnutls/source/39aaa63a1a4cb8432e090887f38241afb2b264a6:README#L103-107 https://gitorious.org/gnutls/gnutls/source/39aaa63a1a4cb8432... not GPL 3 as that file seems to imply

tptacek 12y ago

Though Ryan disagrees strongly, I think this is unfortunate. I think a case can be straightforwardly made that NSS is the better library. Here's a shotgun blast of reasons: * NSS has more institutional constraints; random people in Germany can't, as a general rule, add support for new TLS extensions to it. * NSS has a clearer identity, as the TLS core for Firefox and Chromium. OpenSSL is a grab bag with hundreds of different stakeholders. * The most important code in both NSS and OpenSSL is the SSL state machine. The code for that state machine is incontrovertibly clearer and better expressed in NSS. * NSS has had better battle-testing as a clientside browser TLS library than OpenSSL, which, apart from Android Chrome, isn't a big factor in TLS clientsides. I don't know that anybody loves NSS, but my perception is that more people believe OpenSSL to be hopeless than believe NSS to be. Talking to Brian and Ryan on Twitter yesterday, I proposed that someone generate a list of questions to ask of a TLS codebase --- "what's the code path from first ClientHello to validating the public key signature in a certificate", or, "what's the code that determines which extensions are enabled" --- and we'd take a shot at answering them for NSS, SecureTransport, and OpenSSL. My bet is that the answers to those questions will be more favorable for NSS, even with the crappy certificate handling. Maybe a fork of NSS would be a better plan. However, to head off the drama HN is probably looking for here: one inevitable result of Google transitioning fully to OpenSSL is that OpenSSL will get a lot better, probably quickly.

deleted 12y ago
[deleted]
- deleted 12y ago
  [deleted]
- Wohui 12y ago
  When the ratio of comments to article-upvotes reaches a certain point, threads are punished as 'flamewars'.
  - deleted 12y ago
    [deleted]
  - 12y ago

codewiz 12y ago

The doc mentions this among the cons of NSS: "Certificate path building is C code designed to emulate Java code, through indirection of an average of 7 layers of macros, two platform abstraction layers, and then the remaining NSS abstraction layers (listed above)".

deleted 12y ago

[deleted]