AmiSSL / OpenSSL updates to support TLSv1.1/1.2?

[Hans_]

do some reading up on polarssl then? it is certainly in active development. It is supported by some well known software - openvpn, curl, etc.

[edit] sorry I think I misread - you are referring to the libressl fork ?

I wasn't referring to anything in particular, but did have the libressl fork in mind. It sounded like a lapse in code review process may have allowed the heartbleed vulnerability into OpenSSL, which is the kind of thing that we want to avoid.

I have no idea about the coding standards of the other SSL implementations, but do think that this is worth considering. Something as critical to security as SSL needs a more rigorous development process than your typical application.

Hans

[kvasir]

In the meantime is there a workaround for Ibrowse and such? I've tried using Privoxy and AnalogX proxy servers on a win7 machine, but they both seem to "properly" route https stuff (pass the encrypted data through so the Amiga can decode it, which right now it can't). Perhaps something that decodes on the host machine and passes the decoded stuff to Ibrowse (or aweb/netsurf/etc...)?

[kolla]

Amiga systems are not suited for Internet anyways. With no development or even interest whatsoever in modernising the IP stacks, and with a software suite that is stuck in mid 90ies and close to impossible to update due to status of source code and licenses - why bother.

[olsen]

Amiga systems are not suited for Internet anyways. With no development or even interest whatsoever in modernising the IP stacks, and with a software suite that is stuck in mid 90ies and close to impossible to update due to status of source code and licenses - why bother.

I'm having a really, really hard time reading this as a non-ironic contribution to this thread.

We're in splendid company concerning the restrictions you mentioned. Much of the Internet as it exists today uses TCP/IP stack software which has not changed that much since the 1990'ies. The fundamentals are resilient and still work, in spite of the fact how old the code actually is (portions of the 4.4BSD TCP/IP stack go back to the original BBN implementation).

That SSL/TLS support for AmigaOS is not as nice as it should or could be is a sad fact, but it's arguably a fixable problem which requires a lot of work.

[kolla]

What splendid company? Much? My profession is system and network administrator for an NREN, I have a pretty good idea about which operating systems that have active developed and maintained IP stacks and which do not. The Amiga stacks are so way behind that it is not even funny.

[LoadWB]

Aren't most IP stacks based largely on the BSD reference?  Even if written from scratch, I don't think IPv4 has changed much at all in recent years.

In any case, does RoadShow not count as recent development of IP stack for the Amiga??

[itix]

Aren't most IP stacks based largely on the BSD reference?  Even if written from scratch, I don't think IPv4 has changed much at all in recent years.

I think the message kolla is trying to get through that they lack IPv6 support. And even they did our web applications need to be updated to support IPv6.

Havent still noticed any problems, yet.

[olsen]

What splendid company? Much? My profession is system and network administrator for an NREN, I have a pretty good idea about which operating systems that have active developed and maintained IP stacks and which do not. The Amiga stacks are so way behind that it is not even funny.

The Amiga fares pretty well like all other contemporary consumer grade equipment, including game consoles and other internet-enabled appliances. Which boils down to the fact that the TCP/IP stack is old, aging, and the SSL/TLS functionality may not be up to current standards with regard to the ciphers supported and enabled by default.

That isn't to say that the Amiga stinks, it's just that everybody else doesn't have higher standards either. As for security, you don't have much on the Amiga, and the same tends to be true for internet-enabled appliances. We're in splendid company indeed.

Some of the side-effects of having networking software installed which is behind the curve can be mitigated by not having these devices talk directly to the internet, but have them firmly behind a firewall/router, and no means for the outside world to bypass the filtering.

Such measures only go so far, though. The fact remains that the Amiga is not a secure system, and cannot be reasonably expected to provide such security in the future.

You can't hold this platform to the same standards as you would hold modern, professional grade equipment. The Amiga plays in the "consumer electronics" field, and does not, cannot play with the big boys.

The fundamental TCP/IP stack software and even the SSL/TLS software still does work, though, it's just more brittle than some people, myself included, are comfortable with. But then I'm uncomfortable enabling my AV receiver's "phone home" feature, or my BluRay player's similar functionality. You must assume that the device's maker has no clue about network connected device security and will make you regret enabling it, unless the device maker produces conclusive evidence to the contrary.

[olsen]

Aren't most IP stacks based largely on the BSD reference?  Even if written from scratch, I don't think IPv4 has changed much at all in recent years.

In any case, does RoadShow not count as recent development of IP stack for the Amiga??

Not really. I started writing Roadshow after the OS 3.9 release showed that there was a need for another TCP/IP stack. That was almost 15 years ago. Also, the TCP/IP stack source code which Roadshow is based upon was originally released in 1994 as part of 4.4BSD-Lite2, which makes it barely 5-6 years younger than AmiTCP (which uses code from a 1988/1989 BSD kernel, ported to the MACH kernel).

[olsen]

I think the message kolla is trying to get through that they lack IPv6 support. And even they did our web applications need to be updated to support IPv6.

Havent still noticed any problems, yet.

I believe that IPv6 support will remain a non-issue for at least a decade. There are just too many IPv4-only devices around which cannot be upgraded. And you don't have to upgrade them: your gateway router will at some point talk IPv6 to your ISP, but alsoact as an IPv4 tunnel/gateway, so that you may keep on using your network-enabled devices.

You should start pondering a change to IPv6 as soon as Apple releases products which not only support IPv6 out of the box, but also choose IPv6 as the default configuration (as opposed to IPv4). I don't expect this to happen in this decade.

[kolla]

You have any documentation about Apple not using IPv6 as default? I have had my Apple products on IPv6 only networks, and it worked fine, by default, out of the box.

Your dreamy ISP box is not happening anytime soon, the marked for such a device is not big enough and these days transition protocols are all about making the IPv4 world available for IPv6 only devices - _not_ the other way around, like you suggest!

How do you plan to map the vast number of IPv6 addresses out in the world to the small number of IPv4 addresses behind your magic router?

And no, it is not just IPv6 that lacking, there is also basic stuff like working path MTU discovery, anything doing with multicast (MiamiDx has a little), a whole range of DNS related issues, ancient DHCP implementations...

[slaapliedje]

Exactly what Olsen said about IPv6, but that's not what this topic is about, it's about being able to see some sites with Amiga browsers (I know, it's weird to think we should try to make things compatible with such old things) but still something as basic a necessity as TLSv1.1 support is something I'd hope would be fairly easy to add to which every implementation is currently still being developed.

Most web servers (if they care about their clients) will start forcing at minimum TLSv1.1 (still seems to be things on the fence whether or not TLSv1.0 is vulnerable to the 'poodle' style attack.  Red hat sure thinks it is).

The biggest problem with 'well who cares it's just Amiga' is that if people are completely unaware of this issue, they will think their information is secure when it really isn't.  Granted you'd have to be pretty hard core to only browse the Internet with an Amiga, but I'm sure there are some of you out there that do.  

I'm going to go with a car analogy here... even though they're usually horrible.  Let's say they started coating specific roads for self driving cars.  Of course only fancy rich folks can drive on those.  Well all the stores move to those roads because that's where the money is at.  While those with Dodge Dusters and sell women's shoes are stuck having to go to the crappy mall where they get mugged on a daily basis.  Cops are all paid by the rich, protecting their self-driving cars.

That's pretty much the Amiga.  It's a high pitched woman always spending your money, so you're stuck driving a duster to the mall to sell shoes.  

slaapliedje

[slaapliedje]

You have any documentation about Apple not using IPv6 as default? I have had my Apple products on IPv6 only networks, and it worked fine, by default, out of the box.

Your dreamy ISP box is not happening anytime soon, the marked for such a device is not big enough and these days transition protocols are all about making the IPv4 world available for IPv6 only devices - _not_ the other way around, like you suggest!

How do you plan to map the vast number of IPv6 addresses out in the world to the small number of IPv4 addresses behind your magic router?

And no, it is not just IPv6 that lacking, there is also basic stuff like working path MTU discovery, anything doing with multicast (MiamiDx has a little), a whole range of DNS related issues, ancient DHCP implementations...

Well, sure they probably have it enabled by default, but it's not like they prioritize IPv6 over 4.  And I'd like someone to name a single IPv6 only device.  Really, I'd like to know if one exists.

You know, there's this thing called NAT... and how does having an ancient DHCP implementation affect anything but the Amiga?  It still works fine with my isc-dhcp-server I'm running on my Debian box.  Either way, all of this is irrelevant to the topic at hand of getting newer SSL.

slaapliedje

[kolla]

The ignorance here is frustrating, would be nice if people could read up on the topic.

Yes, any dual stack implementation prioritize IPv6 over IPv4 - that is how it is supposed to work - a host does DNS lookup and if AAAA record exists, that will be used first, and if connection fails it will try the A record. OSX for a long time chose any record it received first from the lookup, but they have fixed that. Smaller devices should not have the overload of full dual-stack, so DS-lite (yeah, ha ha) was developed, that helps them reach IPv4 hosts even though they are primarly IPv6 only.

Any device that is dual stack is also ready to be IPv6 only, and since IPv4 address space is nothing short if being used up, and the IPv4 routing tables get bigger and bigger due to the fragmentation, IPv6 more and more emerges as the cheap and easy way out - when that happens it is bye-bye IPv4 for most ISPs.

NAT wont help you squat, there is NAT64 that today helps people to run IPv6 only LANs to reach IPv4 services, which many wireless providers already do, especially ar universities where thousands and thousand of devices are hooked up at once. Other likely IPv6 devices are cable TV boxes, I know ComCast at least are working a lot with IPv6 in their TV boxes.

My major point is this - the day your ISP says "%&$#?@!%&$#?@!%&$#?@!%&$#?@!it, enough of this IPv4 legacy crap", you are screwed, ISPs can easily flip over night and vast majority of users will not notice. You see, this is how the teansition is meant to work! And no, they will not develop a special magic router just for us retro fans.

[kolla]

Fittefaen, when did amiga.org start with sensoring, how utterly lame.

[kolla]

My point is that, since noone even cares about fixing the situation of the IP stack, I see little point in fixing the SSL situation. And regardless, AmigaOS was not developed with security in mind - _any_ crypting solution on Amiga systems is nothing but FAIL, since any program can sniff around anywhere in the memory. I don't know if MorphOS or OS4 developers take measures, using MMU for example, to sandbox and protect memory where decryptet data is stored, but for sure on AmigaOS this is not the case.