bk99.de entertain the web since 1997

bk99.de
HN · CryptographyCurated

A GnuTLS bug skips certificate checks

Summary

Dan Goodin describes a control flow bug in GnuTLS that caused invalid certificates to be wrongly accepted as valid. Several Linux applications used the library. Distributions released security updates at short notice.

Ideas

  • A wrong return value skipped parts of the certificate validation.
  • Certain error paths accidentally reported success.
  • Applications trusted the library's decision without checking for themselves.
  • A small control flow problem broke the entire authentication.

Insights

  • Cryptography fails more often because of integration than because of mathematics.
  • Error paths deserve the same depth of testing as successful flows.
  • Shared libraries multiply the reach of individual bugs.

Facts

  • The hole affected GnuTLS.

Recommendations

  • Update GnuTLS packages on supported systems.
  • Test certificate errors with deliberately invalid chains.

References

Read the original article

Search the Web Archive

HN · 2016

Crypto 101 explains practical cryptography

Laurens Van Houtven leads from randomness and block ciphers through hashes and MACs to key exchange and signatures. Crypto 101 is available free of charge. The book contains exercises and implementation examples.

CCC · 2008

MD5 is broken: a rogue certificate authority

An international team of researchers demonstrates how MD5 collisions made a validly signed intermediate certificate for a rogue certificate authority possible. The attack produced a fraudulent CA certificate that browsers would accept. System-wide security follows the weakest algorithm that is still accepted.

Let’s Encrypt · 2026

Post-quantum certificates with Merkle trees

Andrew Gabbitas describes how Let’s Encrypt wants to enable post-quantum authentication with Merkle Tree Certificates without slowing down TLS connections with large individual signatures. An ML-DSA-44 signature is about 2,420 bytes. A current ECDSA P-256 signature, by contrast, needs 64 bytes.