<div dir="ltr"><div>Hi Xuelei,</div><div><br></div><div>Webrev 03</div><div>--------------------</div><div><br></div><div> * <a href="http://cr.openjdk.java.net/~sgehwolf/webrevs/mbalaoal/JDK-8148421/webrev.03/">http://cr.openjdk.java.net/~sgehwolf/webrevs/mbalaoal/JDK-8148421/webrev.03/</a> (browse online)</div><div> * <a href="http://cr.openjdk.java.net/~sgehwolf/webrevs/mbalaoal/JDK-8148421/webrev.03/8148421.webrev.03.zip">http://cr.openjdk.java.net/~sgehwolf/webrevs/mbalaoal/JDK-8148421/webrev.03/8148421.webrev.03.zip</a> (download)</div><div><br></div><div>Differences with previous webrev 02:</div><div><br></div><div> * jsse.useExtendedMasterSecret system property was added to completely disable the feature on both client and server sides.</div><div><br></div><div> * Bug fix: if the server does not support TLS 1.0+ version (thus, a previous TLS version was negotiated), the Extended Master Secret extension is not used even if the client sends the extension in its ClientHello message.</div><div><br></div><div> * Bug fix: When TLS 1.0 or 1.1 are used, the session hash is calculated concatenating a MD5 with a SHA1 hash.</div><div><br></div><div> * 2 regression testcases were fixed.</div><div><br></div><div> * knownExtensions array (in ExtensionType class) has now an initial length of 16.</div><div><br></div><div><br></div><div>Feature documentation (for JSSE Reference Guides [1])</div><div>----------------------------------------------------</div><div><br></div><div>## Extended Master Secret Extension</div><div><br></div><div>The Extended Master Secret Extension is a feature that replaces the algorithm used to derive the *master secret* for a TLS session. The new algorithm provides a security enhancement to mitigate attacks such as the [Triple Handshake Attack](<a href="https://www.mitls.org/pages/attacks/3SHAKE">https://www.mitls.org/pages/attacks/3SHAKE</a>). The Extension is defined by [RFC 7627](<a href="https://tools.ietf.org/html/rfc7627">https://tools.ietf.org/html/rfc7627</a>) (*Transport Layer Security (TLS) Session Hash and Extended Master Secret Extension*) and applies to TLS 1.0+.</div><div><br></div><div>Clients and servers need to agree on the usage of this extension during the TLS full handshake, or the previous algorithm is used as a fallback. JSSE supports and enables the Extension by default on both client and server sides. However, for compatibility reasons, disabling is possible by setting *jsse.useExtendedMasterSecret* system property to *false* (i.e. through the *-Djsse.useExtendedMasterSecret="false"* command-line argument).</div><div><br></div><div>### How is the new algorithm different than the previous?</div><div><br></div><div>The original algorithm uses a PRF function to derive the *master secret* from the following inputs: *pre-master secret* (result of a previous key exchange); "master secret" string; and, client and server random values.</div><div><br></div><div>The new algorithm replaces the client and server random values with a hash of the previously exchanged handshake messages. As a result, the session *hash* contains information from certificates, key exchange parameters and other handshake-specific values; in addition to the client and server random numbers. Through binding *master secret* to the connection, an active man-in-the-middle attacker cannot force the generation of an identical value in a parallel connection. Thus, values that depend on the *master secret* for authentication (such as the TLS "tls-unique" binding value) can be trusted.</div><div><br></div><div>### Sessions resumption</div><div><br></div><div>The *master secret* for a TLS session is established during a full handshake. When a session is resumed, the original *master secret* is used without any further negotiations. However, for checking purposes, Extended Master Secret Extension messages are exchanged during the abreviated handshake to indicate that the Extension was used when the original *master secret* was derived. JSSE raises an error if an incongruence is found here.</div><div><br></div><div>Release note: Extended Master Secret Extension support was added to JSSE for both client and server sides</div><div>---------------------------------------------------------------------------------------------------------</div><div><br></div><div>The Extended Master Secret Extension for TLS 1.0+ is now supported on JSSE for both client and server sides. By modifying the algorithm to derive the session *master secret* (during a full handshake) and binding it to connection-specific values, attacks such as the [Triple Handshake Attack](<a href="https://www.mitls.org/pages/attacks/3SHAKE">https://www.mitls.org/pages/attacks/3SHAKE</a>) are mitigated. </div><div><br></div><div>The extension, enabled by default, can be turned off by setting *jsse.useExtendedMasterSecret* system property to *false*.</div><div><br></div><div>See further information about the Extension in [RFC 7627](<a href="https://tools.ietf.org/html/rfc7627">https://tools.ietf.org/html/rfc7627</a>) (*Transport Layer Security (TLS) Session Hash and Extended Master Secret Extension*).</div><div><br></div><div><br></div><div>Testing</div><div>-----------</div><div><br></div><div>I've run jtreg regression tests for the following categories:</div><div><br></div><div> * javax/net/ssl</div><div> * sun/security/ssl</div><div><br></div><div>Results:</div><div> </div><div> * Found 2 bugs running regression tests (both fixed in webrev 03).</div><div><br></div><div> * Found 2 tests broken because of this patch (both fixed in webrev 03).</div><div><br></div><div> * The number of tests that pass is equal with the patch than without, so I assume that no regression was introduced given the current coverage.</div><div><br></div><div>Kind regards,</div><div>Martin.-</div><div><br></div><div>--</div><div>[1] - <a href="http://docs.oracle.com/javase/9/security/java-secure-socket-extension-jsse-reference-guide.htm#JSSEC-GUID-93DEEE16-0B70-40E5-BBE7-55C3FD432345">http://docs.oracle.com/javase/9/security/java-secure-socket-extension-jsse-reference-guide.htm#JSSEC-GUID-93DEEE16-0B70-40E5-BBE7-55C3FD432345</a></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Sat, Aug 26, 2017 at 7:49 PM, Xuelei Fan <span dir="ltr"><<a href="mailto:xuelei.fan@oracle.com" target="_blank">xuelei.fan@oracle.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Martin,<br>
<br>
Sorry for the delay.<br>
<br>
I like this no-API-change design.<br>
<br>
There may be some interoperbility/compatibility issues because of implementation issues of the Extended Master Secret Extension. Maybe, we want an approach to turn off the extension if there is a concern. It could be a system property (for example, jsse.useExtendedMasterSecret="<wbr>false").<br>
<br>
Would you mind file a Compatibility & Specification Review (CSR) request for this feature proposal? For more information, see the CSR wiki at OpenJDK:<br>
<a href="https://wiki.openjdk.java.net/display/csr/Main" rel="noreferrer" target="_blank">https://wiki.openjdk.java.<wbr>net/display/csr/Main</a><br>
<br>
I may have some comments about the implementation if the CSR request get approved.<br>
<br>
Thanks & Regards,<br>
Xuelei<span class=""><br>
<br>
On 8/4/2017 6:18 AM, Martin Balao wrote:<br>
</span><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">
Hi,<br>
<br>
This is my proposal for JDK-8148421 (Support Transport Layer Security (TLS) Session Hash and Extended Master Secret Extension) [1]:<br>
<br></span>
* <a href="http://cr.openjdk.java.net/~sgehwolf/webrevs/mbalaoal/JDK-8148421/webrev.01/" rel="noreferrer" target="_blank">http://cr.openjdk.java.net/~sg<wbr>ehwolf/webrevs/mbalaoal/JDK-81<wbr>48421/webrev.01/</a> <<a href="http://cr.openjdk.java.net/~sgehwolf/webrevs/mbalaoal/JDK-8148421/webrev.01/" rel="noreferrer" target="_blank">http://cr.openjdk.java.net/~s<wbr>gehwolf/webrevs/mbalaoal/JDK-8<wbr>148421/webrev.01/</a>>(browse online)<span class=""><br>
* <a href="http://cr.openjdk.java.net/~sgehwolf/webrevs/mbalaoal/JDK-8148421/webrev.01/8148421.webrev.01.zip" rel="noreferrer" target="_blank">http://cr.openjdk.java.net/~sg<wbr>ehwolf/webrevs/mbalaoal/JDK-81<wbr>48421/webrev.01/8148421.webrev<wbr>.01.zip</a> (download)<br>
<br>
Notes:<br>
<br>
* There is no PKCS#11 support for Extended Master Secret key derivation at this moment. NSS supports it through a vendor-specific type definition (CKM_NSS_TLS_EXTENDED_MASTER_K<wbr>EY_DERIVE and CKM_NSS_TLS_EXTENDED_MASTER_KE<wbr>Y_DERIVE_DH in pkcs11n.h file). Thus, P11TlsMasterSecretGenerator uses the legacy Master Key Derivation method only.<br>
<br>
Thanks in advanced,<br>
Martin.-<br>
<br>
--<br>
[1] - <a href="https://bugs.openjdk.java.net/browse/JDK-8148421" rel="noreferrer" target="_blank">https://bugs.openjdk.java.net/<wbr>browse/JDK-8148421</a><br>
</span></blockquote>
</blockquote></div><br></div>