Secure Defaults for HTTPS/TLS and for Password-Based Key Derivation #10602

nadimkobeissi · 2020-03-04T09:55:13Z

Hello,

I represent Symbolic Software, an applied cryptography consultancy that has been a happy Gitea user for quite some time 😄I am submitting this pull request which provides two important changes to the default configurations of TLS and of password hashing in Gitea.

All changes made in this pull request have been fully tested.

Changes to TLS

Currently, Gitea allows TLS 1.0 and TLS 1.1 for HTTPS connections. These versions of TLS have long been deprecated due to security vulnerabilities, and are also no longer necessary for wide browser compatibility. The change I propose in this pull request sets TLS 1.2 as the minimum TLS version, with additional support for TLS 1.3.

On SSLLabs, we can see the difference. Before my changes:

After my changes:

Changes to Password-Based Key Derivation

Currently, Gitea uses pbkdf2 as the default password hashing function. In this pull request, I replace that with argon2 as the default, for the following reasons:

pbkdf2 is uniquely vulnerable to GPU and ASIC-based attacks that argon2 and scrypt are much less vulnerable against.
pbkdf2 is vulnerable to acceleration attacks and to a host of other attacks that argon2 and scrypt are not vulnerable to.

Therefore, given the above and especially given that argon2 is a well-specified, formally studied design that has won the Password Hashing Competition, I think using it as the default instead of pbkdf2 makes complete sense.

Thank you very much for your work on Gitea, we are huge Gitea fans and look forward to perhaps contributing more in the future.

lafriks · 2020-03-04T10:09:32Z

modules/graceful/server.go

@@ -128,6 +128,8 @@ func (srv *Server) ListenAndServeTLS(certFile, keyFile string, serve ServeFuncti
 func (srv *Server) ListenAndServeTLSConfig(tlsConfig *tls.Config, serve ServeFunction) error {
 	go srv.awaitShutdown()

+	tlsConfig.MinVersion = tls.VersionTLS12


This should be set before when config is creating around here:

gitea/modules/graceful/server.go

Line 123 in c512bfd

return srv.ListenAndServeTLSConfig(config, serve)

Also it would be better if this could be configured in app.ini so that it could be disable in case when needed to use with older browsers or integrations that do not support TLS 1.2

I intentionally set the restriction here to make sure it's enforced across all TLS connections ever made by Gitea. Given the security issues present in TLS 1.0 and 1.1, it doesn't make much sense to run TLS with vulnerable versions instead of not running it.

Even vulnerable security is better than no security and I agree that default should be secure by default but it would be still better to allow for users to change it in case they need it for backward compatibility

OK, what is the best way to expose this via app.ini?

I think same way as password hashing algorithm

I'll work on it and follow up with an update, thank you.

silverwind · 2020-03-04T17:12:53Z

Can we just keep the TLS defaults to golang's defaults (but overrideable)? I don't think we want to manually configure that stuff ideally and golang is certainly faster doing those changes than we are. So with all default, one should get TLS 1.2,1.3 in golang 1.14.

techknowlogick

Thanks for PR :)

Could you split this up into two PRs, one for hash algo change, and another for TLS changes? This allows for reviewing and merging of each specific component and faster merging of a PR without blocking on non-related reviews.

zeripath · 2020-03-04T20:16:19Z

I've fixed the user.yml test case

lafriks · 2020-03-04T22:32:13Z

So actually #10467 might fix tls version issue

nadimkobeissi · 2020-03-05T08:31:20Z

Guys, it's worth noting that Chrome, Firefox and Safari will all completely drop support for TLS 1.0 and 1.1 this month. In light of this news, is it still worth supporting these protocols in Gitea? I strongly but humbly recommend against it.

https://www.zdnet.com/article/browsers-to-block-access-to-https-sites-using-tls-1-0-and-1-1-starting-this-month/

lafriks · 2020-03-05T08:43:38Z

@KAepora in PR #10467 upgrade to golang 1.14 will fix that as it does that by default already so it is not needed to set it in code

nadimkobeissi · 2020-03-05T08:44:48Z

@KAepora in PR #10467 upgrade to golang 1.14 will fix that as it does that by default already so it is not needed to set it in code

@lafriks I could not find a mention of this feature in the Go 1.14 release notes. What gives you the impression that Go 1.14 will default to a minimum of TLS 1.2?

lafriks · 2020-03-05T08:56:49Z

It actually might not, you are right, still it should be moved out to separate PR and set in places where tls.Config is initialized not in code later on

silverwind · 2020-03-05T11:18:50Z

is it still worth supporting these protocols in Gitea

According to https://caniuse.com/#feat=tls1-1 there are still 2.44% users worldwide whose browser does not support TLS 1.1 or higher, so it should at least be an option, but probably not be the default.

techknowlogick · 2020-06-18T02:58:44Z

@olekukonko please use other communication methods for offtopic comments

lunny · 2020-09-02T12:26:21Z

This should be splitted as two PRs.

6543 · 2020-09-02T15:19:03Z

modules/graceful/server.go

@@ -128,6 +128,8 @@ func (srv *Server) ListenAndServeTLS(certFile, keyFile string, serve ServeFuncti
 func (srv *Server) ListenAndServeTLSConfig(tlsConfig *tls.Config, serve ServeFunction) error {
 	go srv.awaitShutdown()

+	tlsConfig.MinVersion = tls.VersionTLS12


@KAepora can you remove this from this pull and resolve confilct
then I think this is ready to mrege

and pleace make a second pull for tlsConfig.MinVersion = tls.VersionTLS12

zeripath · 2020-09-02T21:03:07Z

Looks like @KAepora has deleted their branches so I've remade these PRs and split them.

nadimkobeissi added 2 commits March 4, 2020 10:37

Restrict TLS connections to 1.2 minimum

437c661

Set Argon2 as the default KDF

4158fef

lafriks reviewed Mar 4, 2020

View reviewed changes

GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Mar 4, 2020

lafriks added type/enhancement An improvement of existing functionality topic/security Something leaks user information or is otherwise vulnerable. Should be fixed! labels Mar 4, 2020

lafriks added this to the 1.12.0 milestone Mar 4, 2020

techknowlogick reviewed Mar 4, 2020

View reviewed changes

Fix user.yml

1e4d95b

lafriks modified the milestones: 1.12.0, 1.13.0 May 16, 2020

This comment has been minimized.

Sign in to view

6543 reviewed Sep 2, 2020

View reviewed changes

This was referenced Sep 2, 2020

Use argon as default password hash algorithm #12688

Merged

Set TLS minimum version to 1.2 #12689

Merged

techknowlogick closed this Sep 2, 2020

go-gitea locked and limited conversation to collaborators Nov 24, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Secure Defaults for HTTPS/TLS and for Password-Based Key Derivation #10602

Secure Defaults for HTTPS/TLS and for Password-Based Key Derivation #10602

nadimkobeissi commented Mar 4, 2020 •

edited

Loading

lafriks Mar 4, 2020

nadimkobeissi Mar 4, 2020

lafriks Mar 4, 2020

nadimkobeissi Mar 4, 2020

lafriks Mar 4, 2020

nadimkobeissi Mar 4, 2020

silverwind commented Mar 4, 2020

techknowlogick left a comment

zeripath commented Mar 4, 2020

lafriks commented Mar 4, 2020

nadimkobeissi commented Mar 5, 2020

lafriks commented Mar 5, 2020

nadimkobeissi commented Mar 5, 2020

lafriks commented Mar 5, 2020

silverwind commented Mar 5, 2020

This comment has been minimized.

techknowlogick commented Jun 18, 2020

This comment has been minimized.

lunny commented Sep 2, 2020

6543 Sep 2, 2020

zeripath commented Sep 2, 2020

Secure Defaults for HTTPS/TLS and for Password-Based Key Derivation #10602

Secure Defaults for HTTPS/TLS and for Password-Based Key Derivation #10602

Conversation

nadimkobeissi commented Mar 4, 2020 • edited Loading

Changes to TLS

Changes to Password-Based Key Derivation

lafriks Mar 4, 2020

Choose a reason for hiding this comment

nadimkobeissi Mar 4, 2020

Choose a reason for hiding this comment

lafriks Mar 4, 2020

Choose a reason for hiding this comment

nadimkobeissi Mar 4, 2020

Choose a reason for hiding this comment

lafriks Mar 4, 2020

Choose a reason for hiding this comment

nadimkobeissi Mar 4, 2020

Choose a reason for hiding this comment

silverwind commented Mar 4, 2020

techknowlogick left a comment

Choose a reason for hiding this comment

zeripath commented Mar 4, 2020

lafriks commented Mar 4, 2020

nadimkobeissi commented Mar 5, 2020

lafriks commented Mar 5, 2020

nadimkobeissi commented Mar 5, 2020

lafriks commented Mar 5, 2020

silverwind commented Mar 5, 2020

This comment has been minimized.

techknowlogick commented Jun 18, 2020

This comment has been minimized.

lunny commented Sep 2, 2020

6543 Sep 2, 2020

Choose a reason for hiding this comment

zeripath commented Sep 2, 2020

nadimkobeissi commented Mar 4, 2020 •

edited

Loading