pg.ddx.io pgsql-bugs@postgresql.org mailing list archive
help / color / mirror / Atom feedRFC 9266: Channel Bindings for TLS 1.3 support
4+ messages / 3 participants
[nested] [flat]
* RFC 9266: Channel Bindings for TLS 1.3 support
@ 2022-07-28 20:33 * Neustradamus * <neustradamus@hotmail.com>
2022-07-29 05:44 ` Re: RFC 9266: Channel Bindings for TLS 1.3 support Michael Paquier <michael@paquier.xyz>
0 siblings, 1 reply; 4+ messages in thread
From: * Neustradamus * @ 2022-07-28 20:33 UTC (permalink / raw)
To: pgsql-bugs@lists.postgresql.org <pgsql-bugs@lists.postgresql.org>
Hello all,
Can you add the support of RFC 9266: Channel Bindings for TLS 1.3?
- https://datatracker.ietf.org/doc/html/rfc9266
Little details, to know easily:
- tls-unique for TLS =< 1.2
- tls-exporter for TLS = 1.3
It is linked to:
- https://github.com/postgres/postgres/search?q=tls-unique
Thanks in advance.
Regards,
Neustradamus
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: RFC 9266: Channel Bindings for TLS 1.3 support
2022-07-28 20:33 RFC 9266: Channel Bindings for TLS 1.3 support * Neustradamus * <neustradamus@hotmail.com>
@ 2022-07-29 05:44 ` Michael Paquier <michael@paquier.xyz>
2022-07-29 17:28 ` Re: RFC 9266: Channel Bindings for TLS 1.3 support Jacob Champion <jchampion@timescale.com>
0 siblings, 1 reply; 4+ messages in thread
From: Michael Paquier @ 2022-07-29 05:44 UTC (permalink / raw)
To: * Neustradamus * <neustradamus@hotmail.com>; +Cc: pgsql-bugs@lists.postgresql.org <pgsql-bugs@lists.postgresql.org>; Jacob Champion <jchampion@timescale.com>
Hi,
On Thu, Jul 28, 2022 at 08:33:50PM +0000, * Neustradamus * wrote:
> Can you add the support of RFC 9266: Channel Bindings for TLS 1.3?
> - https://datatracker.ietf.org/doc/html/rfc9266
>
> Little details, to know easily:
> - tls-unique for TLS =< 1.2
tls-unique is not planned, as we have already tls-server-end-point for
TLS1.2 and Postgres requires a certificate, anyway.
> - tls-exporter for TLS = 1.3
>
> It is linked to:
> - https://github.com/postgres/postgres/search?q=tls-unique
So, tls-exporter has been made an official thing, finally. I was
wondering when this was going to happen. Jacob Champion has given me
a patch to support that, based on OpenSSL's SSL_export_keying_material()
to do the job. The base integration is not complicated, but I still
need to think a bit more about it when it comes to the min/max TLS
protocols we allow in libpq, for example, and polish the whole with
tests. We don't force any failures depending on the other connection
parameters for tls-server-end-point, so I suspect that we should be
fine with keeping things at their simplest.
I should be able to get something sent to the mailing lists for the
commit fest of September, so as we could have this feature in v16~.
--
Michael
Attachments:
signature.asc (application/pgp-signature, 832B) download
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: RFC 9266: Channel Bindings for TLS 1.3 support
2022-07-28 20:33 RFC 9266: Channel Bindings for TLS 1.3 support * Neustradamus * <neustradamus@hotmail.com>
2022-07-29 05:44 ` Re: RFC 9266: Channel Bindings for TLS 1.3 support Michael Paquier <michael@paquier.xyz>
@ 2022-07-29 17:28 ` Jacob Champion <jchampion@timescale.com>
2022-07-30 02:38 ` Re: RFC 9266: Channel Bindings for TLS 1.3 support Michael Paquier <michael@paquier.xyz>
0 siblings, 1 reply; 4+ messages in thread
From: Jacob Champion @ 2022-07-29 17:28 UTC (permalink / raw)
To: Michael Paquier <michael@paquier.xyz>; +Cc: * Neustradamus * <neustradamus@hotmail.com>; pgsql-bugs@lists.postgresql.org <pgsql-bugs@lists.postgresql.org>
On Thu, Jul 28, 2022 at 10:44 PM Michael Paquier <michael@paquier.xyz> wrote:
> tls-unique is not planned, as we have already tls-server-end-point for
> TLS1.2 and Postgres requires a certificate, anyway.
I think we can provide tls-exporter for older TLS versions as well, as
long as SSL_get_extms_support() returns 1 for the connection, per
Section 4.2 [1]. That would let people use a unique binding even if
they can't use TLS 1.3 for whatever reason.
> I should be able to get something sent to the mailing lists for the
> commit fest of September, so as we could have this feature in v16~.
Thanks!
--Jacob
[1] https://datatracker.ietf.org/doc/html/rfc9266#section-4.2
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: RFC 9266: Channel Bindings for TLS 1.3 support
2022-07-28 20:33 RFC 9266: Channel Bindings for TLS 1.3 support * Neustradamus * <neustradamus@hotmail.com>
2022-07-29 05:44 ` Re: RFC 9266: Channel Bindings for TLS 1.3 support Michael Paquier <michael@paquier.xyz>
2022-07-29 17:28 ` Re: RFC 9266: Channel Bindings for TLS 1.3 support Jacob Champion <jchampion@timescale.com>
@ 2022-07-30 02:38 ` Michael Paquier <michael@paquier.xyz>
0 siblings, 0 replies; 4+ messages in thread
From: Michael Paquier @ 2022-07-30 02:38 UTC (permalink / raw)
To: Jacob Champion <jchampion@timescale.com>; +Cc: * Neustradamus * <neustradamus@hotmail.com>; pgsql-bugs@lists.postgresql.org <pgsql-bugs@lists.postgresql.org>
On Fri, Jul 29, 2022 at 10:28:19AM -0700, Jacob Champion wrote:
> I think we can provide tls-exporter for older TLS versions as well, as
> long as SSL_get_extms_support() returns 1 for the connection, per
> Section 4.2 [1]. That would let people use a unique binding even if
> they can't use TLS 1.3 for whatever reason.
Ah, good point. Thanks.
--
Michael
Attachments:
signature.asc (application/pgp-signature, 832B) download
^ permalink raw reply [nested|flat] 4+ messages in thread
end of thread, other threads:[~2022-07-30 02:38 UTC | newest]
Thread overview: 4+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2022-07-28 20:33 RFC 9266: Channel Bindings for TLS 1.3 support * Neustradamus * <neustradamus@hotmail.com>
2022-07-29 05:44 ` Michael Paquier <michael@paquier.xyz>
2022-07-29 17:28 ` Jacob Champion <jchampion@timescale.com>
2022-07-30 02:38 ` Michael Paquier <michael@paquier.xyz>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox