GNU bug report logs - #13374
24.?; open-gnutls-stream insecurity

Previous Next

Full log

Message #34 received at 13374 <at> debbugs.gnu.org (full text, mbox):

From: Ted Zlatanov <tzz <at> lifelogs.com>
To: Glenn Morris <rgm <at> gnu.org>
Cc: 13374 <at> debbugs.gnu.org, 13877 <at> debbugs.gnu.org,
	Moritz Ulrich <moritz <at> tarn-vedra.de>
Subject: Re: bug#13877: 24.3; gnutls.el: Enable Certificate Checks
Date: Thu, 14 Mar 2013 08:19:09 -0400

On Tue, 05 Mar 2013 11:51:33 -0500 Glenn Morris <rgm <at> gnu.org> wrote: 

GM> Moritz Ulrich wrote:
>> Currently, gnutls.el doesn't check certificate signatures when used via
>> `open-network-stream' with :type 'tls or `open-gnutls-stream'.

GM> Please see http://debbugs.gnu.org/13374
GM> It was considered too complicated to fix this properly for 24.3.

>> There is NO way to set :verify-host, :verify-flags, etc. for this call
>> to `gnutls-negotiate' when using gnutls via high-level functions like
>> `open-network-stream'.
>> 
>> I consider this a bug, as Emacs won't check any certificates and
>> therefore allow man in the middle attacks without even documenting this.
>> 
>> It should at least be possible to pass :verify-* from
>> `open-network-stream' down to `gnutls-negotiate'. That would be a simple
>> yet effective solution.

I would like to fix this properly now that 24.3 is out, but perhaps the
emacs-devel mailing list is a better place to work on it?

Ted

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.