crypto/tls: RFC 9266: Channel Bindings for TLS 1.3 support

Neustradamus commented 2 years ago

Can you add the support of RFC 9266: Channel Bindings for TLS 1.3?

https://datatracker.ietf.org/doc/html/rfc9266

Channel Bindings for TLS: https://datatracker.ietf.org/doc/html/rfc5929

XEP-0388: Extensible SASL Profile: https://xmpp.org/extensions/xep-0388.html
XEP-0440: SASL Channel-Binding Type Capability: https://xmpp.org/extensions/xep-0440.html
XEP-0474: SASL SCRAM Downgrade Protection: https://xmpp.org/extensions/xep-0474.html
XEP-0480: SASL Upgrade Tasks: https://xmpp.org/extensions/xep-0480.html

Little details, to know easily:

tls-unique for TLS =< 1.2
tls-server-end-point
tls-exporter for TLS = 1.3

Thanks in advance.

ianlancetaylor commented 2 years ago

CC @golang/security @FiloSottile

cherrymui commented 2 years ago

I guess this will be added to the crypto/tls package? What would the support look like? Thanks.

Neustradamus commented 2 years ago

@cherrymui: Yes :)

It is linked to:

cc: @agl, @andres-erbsen, @FiloSottile, @codesenberg, @seankhliao.

Neustradamus commented 1 year ago

Dear all,

I have update the main description about tls-unique, tls-server-end-point, tls-exporter and I have added XEP-0388/XEP-0440/XEP-0474 links.

I think that you have seen the jabber.ru MITM:

FiloSottile commented 1 year ago

RFC 9266, Section 2, says

"tls-exporter" uses Exported Keying Material (EKM), which is already widely exposed by TLS implementations

Indeed, we already support EKM via ConnectionState.ExportKeyingMaterial.

What do you need us to change in crypto/tls?

Neustradamus commented 1 year ago

@FiloSottile: Thanks for your answer but there is not an announcement in code: RFC5929 / RFC9266 And I do not find:

tls-unique
tls-server-end-point
tls-exporter

Example GnuTLS:

morphf commented 10 months ago

Is there an update on this?

WantTrueNerds commented 1 month ago

I think the crypto/tls library already provides support for everything needed to perform channel binding.

"tls-unique" appears to be supported here: https://github.com/golang/go/blob/252fbaf30fab5542f959d3ead59258440a0e0903/src/crypto/tls/common.go#L290
"tls-server-end-point", according to the RFC, simply requires using the hash of the server TLS certificate.
"tls-exporter" appears to be supported here: https://github.com/golang/go/blob/252fbaf30fab5542f959d3ead59258440a0e0903/src/crypto/tls/common.go#L318

Assuming my understanding of the RFC is correct, it appears like everything needed to implement channel binding in other libraries is already available. It would then be up to the downstream libraries (such as go-ldap, etc...) to implement channel binding using these attributes.

Note - the title of this issue mentions specifically TLSv1.3, however it is clear from the initial description that the ask is also intended to include TLSv1.2. The reason I say this is because "tis-unique" is only required to complete channel binding in TLSv1.2, and not TLSv1.3.

P.S. I didn't mean to single out go-ldap here, just used it as an example.

golang / go

crypto/tls: RFC 9266: Channel Bindings for TLS 1.3 support #54103