112 reputation
12
bio website bernd.eckenfels.net
location Karlsruhe, Germany
age 43
visits member for 2 years, 8 months
seen May 28 at 22:51

Chief Architect at a german ISV. Java Guru, IT-Security freak, married and pirate.


May
8
comment Why clients offer handshaking with SSL 2.0 protocol
Actually there are Clients who sent modern packets, and if they do not get proper responses re-try with a more conservative approach (like for example SSL2 record format). This Out Of Band Protocol Fallback is one of the problems in Poodle. Newer Clients are supposed to send a TLS_FALLBACK_SCSV {0x56, 0x00} virtual ciper in that case (so a server can reject those weakend attempts if he thinks he is up-to-date).
Apr
9
comment LDAP Authentication and Sessions
Ah re "AD problem" yes right, its a general LDAP question (but if only AD has a solution for the problem I would be interested in it as well as it is a large customer base).
Apr
9
comment LDAP Authentication and Sessions
Hm, the directory servers I have worked with all check for locked, expired or restricted accounts on bind (at least for the usual conditions). This is exactly why it is usefull, I do not have to know all the different policies a company might have (based on unknown OIDs). (and the question was not about rapid kicking, its more about "within days" for remember-me type of scenarios. (and I am just mildly concerned about storing credentials just like everybody should).
Apr
7
comment LDAP Authentication and Sessions
yes I can check it with fast bind, thats why I like to use it. But I do need to have the password for that. (I have the password at the initial login, but I also need it for re-validation of existing sessions or of rembered sessions, and today I do not have the password handy at those times)
Apr
7
comment LDAP Authentication and Sessions
Hopefully the users use LDAPS if they dont trust the backend network.
Apr
7
comment LDAP Authentication and Sessions
Actually for DB it works quite fine since I normally use a system DB user so I can check every few minutes if the user is not locked or has changed meta data. With LDAP i can do that only when I have a system user, but then I cant use the LDAP server policy enforcing which I get from simple binds.
Apr
7
comment LDAP Authentication and Sessions
Yes, but this does not help me, since I can set a lifetime for a http session as well. In both cases I would need the credentials (password) to re-requerst authentication.
Apr
4
comment Is it possible to make a more secure random number generator algorithm by XORing two or more less secure random number algorithms?
Besides the good answers, I just want to point out, that the problem of combining multiple streams is unfortunately less common than the problem of mixing in untrusted sources into a state pool.
Apr
4
comment LDAP Authentication and Sessions
BTW: not sure how does the Web Browser SSO profile of SAML solve the session problem?
Apr
4
comment LDAP Authentication and Sessions
Yes, we also might use SAML, but this problem here is specific to using LDAP with simple bind as an authentication provider.
Mar
20
comment 1024-bit DHE vs 2048-bit RSA
It is fixed in Java 8 (docs.oracle.com/javase/8/docs/technotes/guides/security/… and docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/…)
Feb
4
comment Is it safe to include timestamps in error codes that are shown to the users?
You could return a short "request ID" instead. If you really have a user who wants to be nice and contact support about the error, thay can report that XID. (You could even add a "sent mail" link which includes it. Having said that, the Date: header with second resolution should be fine.
Feb
4
comment What is the ideal HMAC message format if message is an array?
actually in order to ensure order you need to sort it by key with a fixed comparator. And remeber to also specify the encoding. Personally I would concatenate zero terminated UTF8 bytes (if \0 cannot occur in data).
Oct
17
comment What web browsers support OCSP stapling? Are the privacy and performance features the same?
@bethlakshmi SSL has this revocation problem. CRLs get longer and longer. OCSP is a solution for that but it has the privacy (and soft fail) problem. Both can be solved with OCSP stabling (and must staple extension).
Aug
31
comment Why should I sign data that's already encrypted?
No, beeing able to decrypt it is no gurantee for beeing authentic. Trivial example, if you have a message 0 or 1 (yes or no) and you sent it, somebody can flip the bits in the message without beeing able to decrypt or encrypt it and still reverted the meaning of your message. Thats why my AE answer below is relevant.
Aug
31
comment Why should I sign data that's already encrypted?
BTW, the topic of authenticated encryption (AE) is a quite hot topic, because it was neglected in the past by many implementations. It is especially of a problem, if the encrypted data actually is processed (allowing an attacker to take advantage of bugs in the processor like memory overflow in decompression or executing unwanted commands).
Apr
25
comment SSL cert minimize downtime key rotation strategy
Important: if you generate a new CSR you also need to generate a new key. It is not uncommon to request new certrificates with the old key. But this is generally bad and especially bad for heartbleed mitigation.
Apr
8
comment How exactly does the OpenSSL TLS heartbeat (Heartbleed) exploit work?
@supercat no, the openssl layer which processes records will allocate and store the ssl record based on the (first) record length. This stored record is handed to the extension processing, where another length identifier inside the record is used. And the later one happens to have a larger number. So the memcopy starts at the beginning of the valid record and includes data after it. I suspect its a malloced buffer (even when thats a weird thing for high performance network code.) Check the diagnosis link above.
Apr
8
comment How exactly does the OpenSSL TLS heartbeat (Heartbleed) exploit work?
@supercat I dont think the actual buffers are a problem here, the network buffers get overwritten, so when you extract memeory its only the current stuff in memory. And you cannot overwrite stuff you need later on (like cached sessions). And in fact zeroing is quite a high overhead for web servers. I think however some more static allocation of ssl record buffers would not only improve performance but also leaking random system memory (especialy initially allovated "system parameter" memory like the key)
Apr
8
comment How exactly does the OpenSSL TLS heartbeat (Heartbleed) exploit work?
While it is not a flaw in the TLS extention or the TLS protocol, the TLS specification is still somewhat responsible. The layering of messages inside records and the fact that you typically have multiple length specifications inside those records as a very fragile protocol design and asks for trouble. Even worse when implementations do not abstract the segmentation and parsing away with safe helper methods (so all extension parsers need to reinvent the wheel).