GnuTLS

from Wikipedia, the free encyclopedia
GnuTLS

logo
Basic data

developer Free Software Foundation
Current  version 3.6.13
( March 31, 2020 )
operating system Unix derivatives
programming language C.
category Cryptography
License GPL / LGPLv 2
German speaking No
www.gnutls.org

GnuTLS ( GNU Transport Layer Security Library) is a free implementation of SSL , TLS and DTLS protocols for establishing encrypted network connections .

GnuTLS offers a range of functions similar to OpenSSL , but is licensed under GPL or LGPLv 2 and, in contrast to OpenSSL , can easily be converted into GPL-licensed software such as Gnome , Exim , Lynx on systems where OpenSSL is not part of the normal distribution scope u. be included.

In addition to the most implemented in OpenSSL functions supported GnuTLS TLSv1.1, TLSv1.2, zlib - compression , authentication via Secure Remote Protocol ( SRP ), X.509 - and OpenPGP -key. GnuTLS is used to set up the console application gnutls-cli , the utility program gnutls-servand the application gnutls-cli-debugprogram for troubleshooting the TLS / SSL connections .

controversy

Although originally started as a GNU project , the main developer Nikos Mavrogiannopoulos released GNU TLS from the GNU project in December 2012. The reason was controversy with the Free Software Foundation over policies. A contradiction by Richard Stallman , who recommended forking , was ineffective. In the same month the GNU Sed maintainer Paolo Bonzini followed and resigned from his functions.

Massive security gap between 2018 and 2020

In GnuTLS 3.6.4, which was released on September 24, 2018, a regression damaged the implementation of the TLS protocol (CVE-2020-13777). Because of this error, the TLS server did not create a secure key for the session ticket and only used zeros for encryption and decryption until the first key rotation. In the TLS 1.3 protocol version, attackers can bypass authentication and take over third-party sessions. With TLS 1.2 it is even possible to decrypt saved recordings of previous sessions afterwards. The bug was fixed on June 3, 2020 in GnuTLS 3.6.14.

Individual evidence

  1. ↑ lists.gnupg.org . (accessed on April 12, 2020).
  2. ↑ a b Nikos Mavrogiannopoulos: The perils of LGPLv3 . gnutls.org. March 26, 2013. Retrieved November 18, 2015: “ LGPLv3 is the latest version of the GNU Lesser General Public License. It follows the successful LGPLv2.1 license, and was released by Free Software Foundation as a counterpart to its GNU General Public License version 3. The goal of the GNU Lesser General Public Licenses is to provide software that can be used by both proprietary and free software. This goal has been successfully handled so far by LGPLv2.1, and there is a multitude of libraries using that license. Now we have LGPLv3 as the latest, and the question is how successful is LGPLv3 on this goal? In my opinion, very little. If we assume that its primary goal is to be used by free software, then it blatantly fails that. "
  3. ↑ a b 2013-03-14 Nikos Mavrogiannopoulos (nmav@gnutls.org) * COPYING.LESSER, README: gnutls 3.1.10 is LGPLv2.1
  4. ↑ GnuTLS, copyright assignment, and GNU project governance on lwn.net by Michael Kerrisk (December 20, 2012, English).
  5. ↑ Nikos Mavrogiannopoulos: gnutls is moving . December 18, 2012. Retrieved December 11, 2012.
  6. ↑ GNUTLS is not going anywhere on lists.gnu.org "you cannot take GNUTLS out of the GNU Project." (December 11, 2012).
  7. ↑ Subject: GNU sed 4.2.2 released, and a rant from the maintainer ( Memento from January 29, 2016 in the Internet Archive ) on gmane.comp.lang.smalltalk.gnu.general by Paolo Bonzini (from December 22, 2012, English ).
  8. ↑ gnutls 3.6.4 Release Notes , lists.gnupg.org
  9. ↑ CVE-2020-13777 , cve.mitre.org
  10. ↑ CVE-2020-13777: TLS 1.3 session resumption works without master key, allowing MITM , gitlab.com
  11. ↑ Key zeroed: Update GnuTLS immediately , forum.au-ja.de
  12. ↑ gnutls 3.6.14 release notes , lists.gnupg.org