Category Archives: programming

Response to GnuTLS in Exim Debate

Posted on by — 1 Comment ↓

Marc Haber blogs about GnuTLS in Exim4, and it suggests there is a long list of technical issues in GnuTLS. Given my involvement in GnuTLS, I decided to analyze each bug to see what we can learn and possibly improve.

I looked at the all bugs tagged with gnutls in the exim4 bug tracker. My impression is that Marc Haber has done a very good job as Exim4 maintainer in dealing with these GnuTLS related problems. Some of the frustration seems to be because submitters don’t respond to questions. Also it seems different problems are discussed at the same time, which makes it very difficult to help isolate and solve the problem. The only serious problem I’ve identified is the entropy depletion problem, and the GnuTLS team will try to address it. To me, the concern seems more of a volunteer time issue than a technical one.

Quick Summary

Bug #348046 is so complex that I cannot judge it. If the submitters are willing, it may be best to re-submit each problem separately. The problem with TheBat is interesting, but given the non-free status of TheBat and no other reports, it doesn’t seem serious. To reduce entropy consumption is something we should work on, but it is a ‘wishlist’ kind of bug, and to some extent may have already been solved by removing the DH generation code which depleats the entropy pool quickly. The rest appears to be already solved or should be tagged as ‘wontfix’.
Continue reading →

FSCONS

Posted on by — No Comments ↓

A free software conference in Sweden? That’s a rare one. Organized by the FSFE and Henrik Sandklef, it will be held on the 7-8 December 2007. I hope we’ll see more of this in Sweden. I’m proud to have been invited to talk about both GnuTLS and OpenID. I’m happy to see that there is a OpenMoko talk as well. If you want to participate, there is an early bird discount if you register now. If someone is going and would like to chat, drop me an email.

On TLS-AUTHZ

Posted on by — No Comments ↓

The TLS-AUTHZ document (protocol spec here) describes a mechanism to add support for authorization in the TLS protocol. The idea is part of a patent application, see the patent notification to the IETF. The protocol has a complicated history in the IETF. Right now a third last call is open to request feedback from the community. I’ve written about TLS-AUTHZ before.

RedPhoneSecurity is now trying to circumvent the IETF standardization process by trying to get the document published as an ‘experimental standard’. The document earlier failed to get consensus for publication on the standards track.

The responsible IETF Area Director, Tim Polk, argues that because there exists independent implementations, the community benefits from having the document published. The argument is silly because the only independent implementation is mine and I’m opposed to publication of the standard. Further, the document will remain accessible to anyone in the community with access to the Internet since it has been published as an Internet Draft. To clarify that we have no interest in a standard with patent claims, we have decided to remove the tls-authz implementation from GnuTLS. Together with the FSF we came up with the following statement which is part of the GnuTLS 2.0.2 release announcement:

** TLS authorization support removed.
This technique may be patented in the future, and it is not of crucial importance for the Internet community. After deliberation we have concluded that the best thing we can do in this situation is to encourage society not to adopt this technique. We have decided to lead the way with our own actions.

If you are concerned about having patented standards adopted by the IETF, now is a very good time to make your voice heard! The last call ends on October 23th. Please read about the issue, and familiarize yourself with the IETF process (RFC 2026, with updates related to patents in RFC 3989) and send your feedback to ietf@ietf.org.

GnuTLS v2.0

Posted on by — No Comments ↓

I released GnuTLS v2.0 yesterday, the announcement is available.

So now we can start thinking of nice stuff to have in the v2.1.x series. Integrating the PKCS#11 support is one. ECC support? TLS 1.2 may go into v2.0.x. Opaque PRF input support is planned. Some benchmarking and optimization could be interesting. Other ideas?

Building GnuTLS and GNU SASL without running ./configure

Posted on by — No Comments ↓

Sometimes it can be useful to build things without the autoconf ./configure machinery, and just use a simple and hand-maintained makefile and config.h. This is needed to build things in older uClinux environments. I wrote some instructions on how to build GnuTLS and GNU SASL, and their dependencies (libgpg-error, libgcrypt, libtasn1) without running ./configure, see:

http://josefsson.org/uclinux/old/

The makefile/config.h aren’t specific to uClinux, so if you for some reason need to build these projects in some other environment, without autoconf, the files may be useful.

(Although if you want to build GnuTLS/GSASL properly under a modern uClinux, you’ll be better of reading an earlier post.)

Porting to uClinux

Posted on by — 1 Comment ↓

Building software for embedded systems is quite simple today. A returning customer asked me to clarify how to build gsasl and gnutls under uClinux, and I finally created a web page collecting the instructions and patch.

http://josefsson.org/uclinux/

Libidn now uses Git

Posted on by — 1 Comment ↓

After getting more and more familiar with git, I now moved another project of mine to it. Libidn is not developed heavily anymore, but it is well-maintained, and it served as a good project to test my git skills on.

First TLS v1.2 HTTPS browser in the world?

Posted on by — No Comments ↓

Today I sent some patches for elinks to make it better use the GnuTLS APIs. That made Elinks happily connect using TLS 1.2 to the GnuTLS test server. Would this make it the first web browser ever to support TLS v1.2? Inquiring minds wants to know.

(Yeah, I know that TLS v1.2 is not finalized yet.)

TLS-AUTHZ Patent Concerns

Posted on by — 1 Comment ↓

I’ve implemented tls-authz in GnuTLS but there has been a long discussion of the patent situation for that technology on the IETF list. A few days ago there was a new IPR Disclosure with a patent license for this technology:

https://datatracker.ietf.org/public/ipr_detail_show.cgi?&ipr_id=833

I evaluated this license from a free software perspective, here is my writeup:

http://article.gmane.org/gmane.ietf.general/24690

Libntlm 0.3.13

Posted on by — No Comments ↓

I made a new release of libntlm today. There are no feature changes, just an update of gnulib files which offers better portability (hopefully including Mac OS X now).

I also noticed that I was not subscribed to the libntlm mailing list. Bad maintainer. :)