AmiSSL / OpenSSL updates to support TLSv1.1/1.2?

[kolla]

My point is that, since noone even cares about fixing the situation of the IP stack, I see little point in fixing the SSL situation. And regardless, AmigaOS was not developed with security in mind - _any_ crypting solution on Amiga systems is nothing but FAIL, since any program can sniff around anywhere in the memory. I don't know if MorphOS or OS4 developers take measures, using MMU for example, to sandbox and protect memory where decryptet data is stored, but for sure on AmigaOS this is not the case.

[Hans_]

My point is that, since noone even cares about fixing the situation of the IP stack, I see little point in fixing the SSL situation. And regardless, AmigaOS was not developed with security in mind - _any_ crypting solution on Amiga systems is nothing but FAIL, since any program can sniff around anywhere in the memory. I don't know if MorphOS or OS4 developers take measures, using MMU for example, to sandbox and protect memory where decryptet data is stored, but for sure on AmigaOS this is not the case.

Sure, the local security will be the weak point in the chain, but SSL/TLS still prevents communications from being snooped on as the packets are relayed through the internet. Plus, there's a slow trend toward websites being HTTPS only (Google's pushing for this).

Hans

[kolla]

Of course, I'm just saying that a browser running on an amiga like system is an easy target for abuse, even when https is used.

Regarding IPv6, I checked with peers on an IPv6 forum to make sure there's nothing I have overlookef, and they all agree with me. Only solution would be a stateful NAT46/DNS46 implementation, something that has not been done yet, and it would be very cumbersome and inpractical since you simply cannot map 128bit address space into a 32bit address space. And do no expect ISPs to fix this, they are steadily moving towards IPv6 only to customers, many of them already use IPv6 only for management. It is coming and sooner than you think now.

[LoadWB]

Okay, so Amiga TCP/IP is aged.  Does it still work?  Will it work for a while?  At least long enough to ensure that data in-transit is secured?  At this point in the real world if the consensus is that Amiga should isolated from the Internet due to existing network deficiencies and should never be fixed, you might as well just wrap it up and put it in a box forever.  If a platform is going to be useable for more than just game playing, arguably out-dated graphic design, and word processing, it must have access to the outside world.  Anything is programmatically possible -- hell, you could implement SSL in 6502, it just might be unusably slow, but still possible -- so saying that something is "FAIL" or useless should not imply nor be inferred that it should not be done.

All things considered, I couldn't give two rats turds about IPv6.  That bell has been ringing for over 14 years and it's still just piss in the wind.  As it is, I can route my IPv6 network through an 6-to-4 gateway at Hurricane just fine.  Should we expect that the reverse will never be possible?  The experts out there may not think so or may not want it, but the market of users with older equipment not willing or able to upgrade will make that decision.  And where the market bucks the experts there is money to be made, so I suspect entrepreneurs will help fill the void.

(FWIW, since my network has a unified threat management device (they're really cheap these days, along the same price as any good business-class non-UTM firewall,) all of my secure connections are decrypted at the firewall which then makes the secure connection to the far end.  So for me the SSL/TLS issue is moot as the firewall will ultimately determine security heading out into the world.)

But, again, the arguments of IPv6 and IPv4 are off-topic for this thread, which is about getting TLS v1.1 and v1.2 support on the Amiga.

[slaapliedje]

Thank you to everyone who is not Kolla, who seem to support my thoughts.

For the record, 'they' really have been saying that for a very long time (14 years sounds about right).  Hell, they were at least a few years ago that IPv4 was over, and everyone had to switch over to IPv6 NOW!  What happened?  Nothing.  Even CenturyLink (my ISP) was saying that they were doing it... then when I tried to configure my modem to use IPv6, it simply didn't work.  I finally managed to get it to work, so now both IPv6 and IPv4 work fine, and the whole reason NAT still works and will work forever is because you can easily have a firewall/router in place that will still translate your internal network for you so you can browse the Internet.  There is no way they'll ever just drop that capability, because there are far too many systems out there that would simply stop working, and there are (non-US) countries out there who actually care about consumer rights.

It's like when Sony removed the Other OS option in the PS3.  There was a huge uproar about that.  Imagine if all IPv4 only devices stopped working on the Internet tomorrow?

Yes, back on topic, the support for newer versions of the SSL stack (TLS1.1 and TLS1.2) are simply needed for something that'll happen sooner than IPv6 only everywhere, and that would be HTTPS everywhere.  I noticed amiga.org doesn't use https by default.  I actually had to switch my server back to SSLv3 support, just so I could log into my webmail and get something I had ordered for my Amiga out of my email.  (HSmathlibs)  So yes, there is a reason for a networked Amiga.  Could I have dropped it into an NFS share or an FTP server?  Sure.  It was more convenient to read it straight out of my email though.

This is pretty typical though of a lot of Amiga-related discussions.  "Well who cares, I don't use that anyhow, and it's old, let it die!"  Well, I am pretty sure the same SSL stack is used on OS4 and MorphOS, so wouldn't they really want to fix this?

slaapliedje

[Hans_]

Regarding IPv6, I checked with peers on an IPv6 forum to make sure there's nothing I have overlookef, and they all agree with me. Only solution would be a stateful NAT46/DNS46 implementation, something that has not been done yet, and it would be very cumbersome and inpractical since you simply cannot map 128bit address space into a 32bit address space. And do no expect ISPs to fix this, they are steadily moving towards IPv6 only to customers, many of them already use IPv6 only for management. It is coming and sooner than you think now.

I recently read an article in an IEEE magazine about IP protocol extensions that adds several billion addresses in a way that's backward compatible to existing IPv4 stacks. I think that they're all based on this doc, but I can't find the article. These extensions could keep IPv4 running for a while longer while they wait for IPv6 to be more widely deployed.

Hans

[slaapliedje]

I say we take this into consideration.  HTTPS everywhere is most likely to happen far sooner than IPv6 only, especially in light of extensions like that.  So we figure out how to fix AmiSSL (or other project), then work on getting IPv6 working.  

While of course we get NetSurf (or other) to work with native widgets (MUI?).  Would be sweet if we at least had some basic CSS support, which seems to be the way a lot of the Web is going.

As long as pages aren't using really heavy javascript, then even ibrowse is pretty fast.  After I finally got my Amikit for Real set up on my A4000D, it loads pages really fast, as long as there isn't any heavy javascript.  

slaapliedje

[itix]

This is pretty typical though of a lot of Amiga-related discussions.  "Well who cares, I don't use that anyhow, and it's old, let it die!"  Well, I am pretty sure the same SSL stack is used on OS4 and MorphOS, so wouldn't they really want to fix this?

It is already fixed. OWB is using rather decent openssl 1.0.1g

http://fabportnawak.free.fr/owb/owb-morphos-1.24.readme

Like I said when it is a link library changes can be quickly adopted to the software. AmiSSL way is neat but shared libraries need more testing and active maintainers.

So my suggestion is software developers should not use AmiSSL anymore but use openssl or similar library directly. You get security fixes sooner, you cut development time and you achieve same results.

[slaapliedje]

It is already fixed. OWB is using rather decent openssl 1.0.1g

http://fabportnawak.free.fr/owb/owb-morphos-1.24.readme

Like I said when it is a link library changes can be quickly adopted to the software. AmiSSL way is neat but shared libraries need more testing and active maintainers.

So my suggestion is software developers should not use AmiSSL anymore but use openssl or similar library directly. You get security fixes sooner, you cut development time and you achieve same results.

Good to know, whatever happened to the port of OWB to 3.9/m68k?  I know there is an earlier build of it, but it was horribly broken last time I tried it.

slaapliedje

[itix]

Good to know, whatever happened to the port of OWB to 3.9/m68k?  I know there is an earlier build of it, but it was horribly broken last time I tried it.

OWB relies heavily on MUI4 so it is not easy to port it to 3.9. It would need someone who know MUI quite well. And you have to get latest openssl compiled. It should be fairly easy (I suppose so) but all those little details add up.

Problem with 68k Amiga is there is no team maintaining development system and APIs are not actively updated. So this topic, AmiSSL / OpenSSL updates comes to the fact that we (well, you) need a team behind Amiga.

[slaapliedje]

Ha, yeah isn't that the painful truth.  

I noticed they are finally doing something with m68k MUI (updated to 3.9 beta).

I also found this;

http://sourceforge.net/p/amissl/code/HEAD/tree/

Looks like they're updating it to OpenSSL 1.0.1i

I'm going to see if I can create a cross compiling environment (first, seems easier than getting a compiling environment under the Amiga itself).  Then compile it and test it out.

Anyone try this?

http://fengestad.no/m68k-amigaos-toolchain/

slaapliedje

[olsen]

Ha, yeah isn't that the painful truth.  

I noticed they are finally doing something with m68k MUI (updated to 3.9 beta).

I also found this;

http://sourceforge.net/p/amissl/code/HEAD/tree/

Looks like they're updating it to OpenSSL 1.0.1i

They are *trying* to update it, and they met with substantial difficulties with regard to how OpenSSL can be ported to the Amiga.

[olsen]

You have any documentation about Apple not using IPv6 as default? I have had my Apple products on IPv6 only networks, and it worked fine, by default, out of the
box.

Good point. And bonus points for actually trying this ;-)

The last time I was this adventurous I found that my Mac Mini basically did work with my dual-stack ADSL gateway router, but there was no actual benefit (my ISP only supports IPv4, and IPv6 traffic was tunneled by my gateway router). In the end I stuck to IPv4 and disabled IPv6 negotiation.

What I was getting at, however, is in Apple making IPv6 the default option and disabling IPv4 configuration by default, leaving it to the customer's discretion to enable it if needed. As far as I know this hasn't happened yet. In your typical home network setup you will still find devices which only support a single IPv4 stack, and which are not easily replaced.

Your dreamy ISP box is not happening anytime soon, the marked for such a device is not big enough and these days transition protocols are all about making the IPv4 world available for IPv6 only devices - _not_ the other way around, like you suggest!

Hm... that sounds like network engineering talk rather than sales talk to me. How are you going to sell this to the customer? He'll have to replace gear that isn't broken, maybe only 3-4 years old, doesn't support IPv6, or shows IPv6 interoperability issues. What now?

This isn't going to be a niche problem. The possible solutions for keeping IPv4-only devices connected to the Internet which I read about didn't exactly warm my heart. If it's web-only traffic, you could solve the problem with a traditional HTTP proxy, maybe even a socks-like service for the rest. But that proxy would have to sit in the network of your ISP, which would raise privacy issues, to say the least (correlating DNS lookups with TCP connections isn't so simple today, but with such a proxy solution your ISP will know both). Would you trust your ISP to proxy your encrypted web/mail/whatever traffic?

How do you plan to map the vast number of IPv6 addresses out in the world to the small number of IPv4 addresses behind your magic router?

Through some unholy combination of NAT and DNS. The number of connection end point tuples your basic IPv4 firewall needs to be able to wrestle with is comparatively small over time, if you're connecting a home network to the Internet through a gateway router. Caching/mapping AAA record information from DNS queries is ugly, but could be done assuming that the number of records that would have to be dealt with is small over time, too. Tweaking DNS lookups in this manner could just about work in home network, but it would create problems if the mapping between IP address and DNS record were use for purposes of verifying correctness. You could forge DNS records and the DNS proxy/mapping solution would make it impossible to detect the forgery.

Things will undoubtedly get really ugly the more important IPv6 deployment becomes, rendering a IPv4/IPv6 NAT/DNS mapping scheme unwieldy. But I bet you five Eurocents that this is what we'll get at some point when the transition from IPv4 to IPv6 happens.

And no, it is not just IPv6 that lacking, there is also basic stuff like working path MTU discovery, anything doing with multicast (MiamiDx has a little), a whole range of DNS related issues, ancient DHCP implementations...

Yes, it would be helpful to have path MTU discovery. For me (Roadshow lacks MTU discovery) this is a customer support problem. Luckily, you can get get by with a 1500 octet Ethernet MTU today. This used to be very different a decade ago.

[olsen]

My major point is this - the day your ISP says "%&$#?@!%&$#?@!%&$#?@!%&$#?@!it, enough of this IPv4 legacy crap", you are screwed, ISPs can easily flip over night and vast majority of users will not notice. You see, this is how the teansition is meant to work! And no, they will not develop a special magic router just for us retro fans.

Do you actually believe that this is a sensible strategy? No doubt it's possible to make this change, and at the ISP's side of the business it matters little what flavour the IP packets have, but does it benefit the customer in any way whatsoever?

The ongoing transition from the plain old telephone system and its more modern digital telephony incarnation to VoIP is not exactly a painless process either, and in the end the only thing the customer may have to do is to replace a comparatively cheap handset.

Home users and corporations still use ISDN gear, almost ten years after it became clear that IP had won the battle. Unlike for hand-held mobile devices there is no steady product development cycle which drives sales and replacement of old gear in this market. Dual stacked IP network devices have only started to become cheap and robust in the last few years.

Unless your ISP can afford not to care about its customers (not unheard of; prevalent in countries in which there is no or very little market competition), a forced switch from IPv4 to IPv6 would be economically unsound.

[kvasir]

Found a work-around (granted, and ugly one) for ssl right now. I was able to log into Facebook (one of the sites that Ibrowse chokes on) with Icab 2.9.9 running on shapeshifter. ( http://www.icab.de ) Netscape didn't work, though. This requires a pretty heavily upgraded Amiga to do well, though.

[kvasir]

OK, just tried using Aweb to log into Facebook ( m.facebook.com ), and it worked. Though, the os3.9 version of Aweb seems to work while any I've downloaded doesn't for some reason. Wish Ibrowse could be made to work though, because its alot faster. With this working right on an Amiga browser, perhaps a general https: proxy server compiled for AOS would work?