diff options
| author | David Benjamin <davidben@google.com> | 2024-04-13 17:40:13 -0400 |
|---|---|---|
| committer | Boringssl LUCI CQ <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com> | 2024-04-22 15:46:08 +0000 |
| commit | ad36a4fc4a825b7874fde30c95a196b71ae044a8 (patch) | |
| tree | c702378349eeee6622e851f21ef8b96341950890 /include | |
| parent | 0aa300b9ba9d66b914793ad18c5b469163e58905 (diff) | |
| download | boringssl-ad36a4fc4a825b7874fde30c95a196b71ae044a8.zip boringssl-ad36a4fc4a825b7874fde30c95a196b71ae044a8.tar.gz boringssl-ad36a4fc4a825b7874fde30c95a196b71ae044a8.tar.bz2 | |
Make SSL_CTX_set_keylog_callback constant time
We encode the secrets in hex. When we do so, we should not leak them
based on memory access patterns. Of course, the caller is presumably
going to leak them anyway, because this is the SSLKEYLOGFILE callback.
But it's plausible that the caller might have registered the callback
unconditionally and then, in the callback, decide whether to discard the
data. In that case, we should not introduce a side channel.
Change-Id: If6358a3081c658038232b4610603967cb38659b4
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/67829
Reviewed-by: Bob Beck <bbe@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
Diffstat (limited to 'include')
| -rw-r--r-- | include/openssl/ssl.h | 13 |
1 files changed, 11 insertions, 2 deletions
diff --git a/include/openssl/ssl.h b/include/openssl/ssl.h index 97f1c89..04c191f 100644 --- a/include/openssl/ssl.h +++ b/include/openssl/ssl.h @@ -4376,8 +4376,17 @@ OPENSSL_EXPORT void SSL_set_msg_callback_arg(SSL *ssl, void *arg); // // The format is described in // https://www.ietf.org/archive/id/draft-ietf-tls-keylogfile-01.html -OPENSSL_EXPORT void SSL_CTX_set_keylog_callback( - SSL_CTX *ctx, void (*cb)(const SSL *ssl, const char *line)); +// +// WARNING: The data in |line| allows an attacker to break security properties +// of the TLS protocol, including confidentiality, integrity, and forward +// secrecy. This impacts both the current connection, and, in TLS 1.2, future +// connections that resume a session from it. Both direct access to the data and +// side channel leaks from application code are possible attack vectors. This +// callback is intended for debugging and should not be used in production +// connections. +OPENSSL_EXPORT void SSL_CTX_set_keylog_callback(SSL_CTX *ctx, + void (*cb)(const SSL *ssl, + const char *line)); // SSL_CTX_get_keylog_callback returns the callback configured by // |SSL_CTX_set_keylog_callback|. |