Deluge
2017-06-15 15:37:21 UTC
#3065: Enhance TLS security
-----------------------------+----------------------------
Reporter: Jay-C | Owner:
Type: feature-request | Status: new
Priority: minor | Milestone: needs verified
Component: Web UI | Version: develop (git)
Keywords: TLS security |
-----------------------------+----------------------------
Following a consideration on [http://dev.deluge-torrent.org/ticket/3064
ticket 3064].
To meet industry standards on SSL/TLS security and to increase security
headroom when exposing the Web UI to the Internet, I believe that some
changes are required on the transport side.
1. Disable TLS v1.0. Only allow TLS >= v1.1 ([https://blog.varonis.com
/ssl-and-tls-1-0-no-longer-acceptable-for-pci-compliance link]). All
reasonably modern browsers should have no problem with this.
2. Respect certificate x509 extensions, especially key usage
For example: Currently, if keyUsage is set to "critical,
digitalSignature", which should forbid plain RSA since that is a
keyEncipherment operation, the server will happily still use plain RSA.
That is... bad.
3. Enable (only) (elliptic curve or regular) Diffie-Hellman epidermal key
exchange cipher suites.
This is necessary to provide Perfect Forward Secrecy. This requires adding
DH parameters, but it shouldn't be to hard to generate with dhparams and
include it with the distribution or generate it dynamically. Currently
there's only plain RSA cipher suites enabled.
4. Tweak cipher list to prefer AES GCM modes and disable MD5/DES/RC4.
More resistant to certain types of attacks. Current list seems to prefer
AES CBC for some reason.
(1) and (4) can be trivially done now but might break compatibility with
some outdated clients. (2) I don't know about if Twisted even supports.
(3) requires a newer version of Twisted than currently in the Trusty
repositories.
--
Ticket URL: <http://dev.deluge-torrent.org/ticket/3065>
Deluge <http://deluge-torrent.org/>
Deluge Project
-----------------------------+----------------------------
Reporter: Jay-C | Owner:
Type: feature-request | Status: new
Priority: minor | Milestone: needs verified
Component: Web UI | Version: develop (git)
Keywords: TLS security |
-----------------------------+----------------------------
Following a consideration on [http://dev.deluge-torrent.org/ticket/3064
ticket 3064].
To meet industry standards on SSL/TLS security and to increase security
headroom when exposing the Web UI to the Internet, I believe that some
changes are required on the transport side.
1. Disable TLS v1.0. Only allow TLS >= v1.1 ([https://blog.varonis.com
/ssl-and-tls-1-0-no-longer-acceptable-for-pci-compliance link]). All
reasonably modern browsers should have no problem with this.
2. Respect certificate x509 extensions, especially key usage
For example: Currently, if keyUsage is set to "critical,
digitalSignature", which should forbid plain RSA since that is a
keyEncipherment operation, the server will happily still use plain RSA.
That is... bad.
3. Enable (only) (elliptic curve or regular) Diffie-Hellman epidermal key
exchange cipher suites.
This is necessary to provide Perfect Forward Secrecy. This requires adding
DH parameters, but it shouldn't be to hard to generate with dhparams and
include it with the distribution or generate it dynamically. Currently
there's only plain RSA cipher suites enabled.
4. Tweak cipher list to prefer AES GCM modes and disable MD5/DES/RC4.
More resistant to certain types of attacks. Current list seems to prefer
AES CBC for some reason.
(1) and (4) can be trivially done now but might break compatibility with
some outdated clients. (2) I don't know about if Twisted even supports.
(3) requires a newer version of Twisted than currently in the Trusty
repositories.
--
Ticket URL: <http://dev.deluge-torrent.org/ticket/3065>
Deluge <http://deluge-torrent.org/>
Deluge Project
--
You received this message because you are subscribed to the Google Groups "Deluge Dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to deluge-dev+***@googlegroups.com.
To post to this group, send email to deluge-***@googlegroups.com.
Visit this group at https://groups.google.com/group/deluge-dev.
For more options, visit https://groups.google.com/d/optout.
You received this message because you are subscribed to the Google Groups "Deluge Dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to deluge-dev+***@googlegroups.com.
To post to this group, send email to deluge-***@googlegroups.com.
Visit this group at https://groups.google.com/group/deluge-dev.
For more options, visit https://groups.google.com/d/optout.