Re: STARTTLS vulnerabilities

[Eric Blake <eblake () redhat com>]

On Wed, Aug 11, 2021 at 08:16:34AM +0200, Hanno Böck wrote:
> Of course it's a very obvious idea for further research to look if one
> finds similar vulnerabilities to the ones we found in other protocols.
> So I'd really like to encourage other people to look for this.
>
> FWIW there are a lot of protocols with a STARTTLS mechanism, here's the
> list of supported protocols by OpenSSL:
>       smtp
>       pop3
>       imap
>       ftp
>       xmpp
>       xmpp-server
>       telnet
>       irc
>       mysql
>       postgres
>       lmtp
>       nntp
>       sieve
>       ldap

Not mentioned in that list was ndb, but as far as I can tell, that
project has already documented the ramifications of opportunistic
encryption as being a security risk, and all known implementations
(both servers and clients) with TLS support have a mode of execution
that ensures the connection is dropped if a downgrade attack is
attempted:

https://github.com/NetworkBlockDevice/nbd/blob/master/doc/proto.md#security-considerations
https://lists.debian.org/nbd/2021/08/msg00031.html

But I welcome review from those with more experience from the security
side of things.

-- 
Eric Blake, Principal Software Engineer
Red Hat, Inc.           +1-919-301-3266
Virtualization:  qemu.org | libvirt.org