Unknown PSK Identity and Bad PSK should be both handled in a same way #605
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
boaks
reviewed
Apr 9, 2018
| @@ -689,7 +689,7 @@ private void createCertificateRequest(final ClientHello clientHello, final DTLSF | |||
| if (psk == null) { | |||
| throw new HandshakeException( | |||
There was a problem hiding this comment.
It may be academic, but wasn't the discussion, that in this case, a random secret is assumed to "fake" the calculation times?
There was a problem hiding this comment.
As we don't answer at all, there is no calculation time to detect.
But if we had chosen to send "decrypt_error" alert, we should have to do something like this. (I mean fake calculation)
This is one of the reason which make this solution simple to implement.
There was a problem hiding this comment.
:-). If we do a parallel handshake, we may see the difference there :-).
boaks
reviewed
Apr 9, 2018
| // In production both should be silently ignored : https://bugs.eclipse.org/bugs/show_bug.cgi?id=533258 | ||
| if (AlertDescription.UNKNOWN_PSK_IDENTITY != description) { | ||
| terminateOngoingHandshake(record.getPeerAddress(), cause, description); | ||
| } |
There was a problem hiding this comment.
Add return to skip discardRecord?
Otherwise the log may be irritating.
sbernard31
force-pushed
the
unknown_identity
branch
from
cafb172
to
b25bfd5
Compare
sbernard31
force-pushed
the
unknown_identity
branch
from
b25bfd5
to
74965dc
Compare
|
LGTM |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR aims to fix this issue : https://bugs.eclipse.org/bugs/show_bug.cgi?id=533258.
An "unknown PSK identity" will be ignored as a "bad PSK".