jdev - 2023-10-25

lovetox, is there a bug report or something you can share?

https://gitlab.gnome.org/GNOME/pygobject/-/issues/603

Thanks

Hi, I’m adding channel binding support for TLS 1.2, in which RFC are the TLS label and context defined?

For TLS 1.3 that’s 9266 and it’s quite clear.

I'd look for references in the SCRAM and SASL RFCs

Link Mauve, TLS unique: https://datatracker.ietf.org/doc/html/rfc5929

ah, and the other stuff, too.

Do I want to know what tls-unique-for-telnet is?

> For more discussions of channel bindings, and the syntax of channel > binding data for various security protocols, see [RFC5056].

ah, and > Clients SHOULD implement the "tls-unique" [RFC5929] channel binding type

jonas’, do you want your eyeballs happy?

Is the unique prefix the label?

Why is context not specified?

When I try that I receive an Err(Auth(Fail(NotAuthorized))) back.

(I quoted RFC5802 ftr) ✏

Link Mauve, hm?

I’m trying with tls12.badxmpp.eu.

Ah, with no context instead of an empty string context it seems to work!

Hmm no, I always get NotAuthorized…

Well, you don't have an account there, do you?

Have I even made accounts there?

But it always works, no matter the label I put, does that mean the channel binding is ignored in that case?

What do you mean by 'label' here?

And what does 'work' mean?

tls_connection.export_keying_material(data, b"foo", Some(b"bar"))?

Label is "foo", context is "bar".

Is that tls-unique?

Using the terminology here: https://www.rfc-editor.org/rfc/rfc9266.html

I am sending p=tls-unique,, yes.

I thought that was the Finsihed message, not TLS exporter anything

Link Mauve, I can provide a server for testing if you want

Could set up well-known user/passwords on badxmpp.eu but disable resource binding, disconnect on sasl-success or something

I could also disable TLS 1.3 in my library I guess.

TLS 1.3 with tls12.badxmpp.eu should not work

Zash, could be nice indeed!

Zash, but my library should fall back to TLS 1.2 if TLS 1.3 isn’t supported.

Link Mauve, badxmpp.eu runs the prosody stable version, there's no tls-exporter, I don't think that RFC and API is the thing

https://datatracker.ietf.org/doc/html/rfc5929#section-3

https://github.com/brunoos/luasec/blob/master/src/ssl.c#L706-L758 is what's used for tls-unique, while https://github.com/brunoos/luasec/blob/master/src/ssl.c#L760-L793 is what tls-exporter uses, completely different API