search

h2o / picotls

TLS 1.3 implementation in C (master supports RFC8446 as well as draft-26, -27, -28)
536 stars 140 forks source link

Unclear note #539

Open doublex opened 1 month ago

doublex commented 1 month ago

This note: Note 1: Minicrypto binding is capable of signing a handshake using the certificate's key, but cannot verify a signature sent by the peer.

Question: Does this mean that picotls is vulnerable to man-in-the-middle attacks when used as a client?

huitema commented 3 weeks ago

A client using picotls with the minicrypto backend is indeed vulnerable to MITM attacks. A client using picotls with the openssl backend is not. The MbedTLS work in progress would fix that, but using picotls with the MbedTLS backend is currently only supported when using the picoquic implementation of QUIC.

Servers using picotls and either backend are OK.

doublex commented 3 weeks ago

@huitema Do you think it would be complicated to implement signature verification in minicrypto?

huitema commented 2 weeks ago

It depends. If you want to support HTTP, for example, you must be able to verify the certificates commonly used on the web, and that means having implementations of RSA, ECDSA, etc. This means finding a package that implements them and can be used by picotls. Then, you will need to write the certificate chain verifier, with all its complexity. And you will have to deal with managing the error cases, decide whether to bypass them, etc. It can be a big job, and any bug translates into a security issue for the application.

An alternative would be, write that as a separate package, outside of picotls, and provide the certificate verification function that can be used by the application.