Slashdot Mirror

← Back to Stories (view on slashdot.org)

OpenSSL To Undergo Massive Security Audit

Posted by timothy on from the cracking-down-on-cracking-down dept.

rjmarvin writes Now that its codebase is finally viewed as stable, OpenSSL is getting a good top-to-bottom once-over in the form of a sweeping audit. As part of the Linux Foundation's Core Infrastructure Initiative, the foundation and the Open Crypto Audit Project are sponsoring and organizing what may arguably be the highest-profile audit of a piece of open-source software in history. The audit itself will be conducted by the information assurance organization NCC Group, and its security research arm, Cryptography Services, will carry out the code review of OpenSSL's 447,247 line codebase over the next several months.

8 of 69 comments (clear)

  1. Must be designed secure - not "coded" by cjonslashdot · · Score: 4, Informative

    Code cannot be claimed to be secure unless it has been designed with secure design patterns - patterns for which there is an "assurance argument". If the code was "coded" instead of designed, then there is no hope of creating assurance arguments after the fact. In that case, the audit will be very difficult and untrustworthy.

    1. Re:Must be designed secure - not "coded" by nightsky30 · · Score: 4, Insightful

      Couldn't the first step be libreSSL? They cleaned out a ton of junk and applied some uniform coding standards. That would be much easier to audit, and a much sounder base.

    2. Re:Must be designed secure - not "coded" by arglebargle_xiv · · Score: 5, Insightful

      Couldn't the first step be libreSSL? They cleaned out a ton of junk and applied some uniform coding standards. That would be much easier to audit, and a much sounder base. Flag as Inappropriate

      Exactly (no mod points left, sorry). Auditing OpenSSL makes about as much sense as auditing Windows 95, we already know it's broken beyond repair, and any further effort expended on it is just throwing good money after bad. Focus on something that's worth going with, like LibreSSL, or something that was never OpenSSL to begin with.

  2. Not the time... by x0ra · · Score: 4, Interesting

    Why bother with a security audit of the whole OpenSSL as-is, right here, right now, when the LibreSSL fork has been doing a lot of work removing years of unmaintained cruft (cf. http://en.wikipedia.org/wiki/L...) ? It seems to be an exercise in futility... I also wonder why get the job to a private company, which would certainly result in very bad transparency, when they could just launch a bounty program rewarding exploits & bug findings ?!?

  3. In Related News... by Bob9113 · · Score: 4, Funny

    NCC Group, and its security research arm, Cryptography Services, will carry out the code review

    In related news, NCC Group today received 37 applications from extraordinary qualified candidates, all of whom -- by some extraordinary coincidence -- live in Langley, VA.

    --
    Stop-Prism.org: Opt Out of Surveillance
  4. Re:I'm gonna FREAK! by ralphsiegler · · Score: 5, Informative

    A team with leadship in the realm of secure software already did that, starting about 11 months ago. The OpenSSL code didn't just need audited, it need large swaths of code thrown in the trash, and code refactored for security, readability, and ease of debugging. And fixes made. Which is being done. http://www.libressl.org/

  5. OpenSSL Valhalla Rampage blog by thatseattleguy · · Score: 4, Insightful
    Perhaps here is a good place to mention that you could learn more about real-world security auditing and code hardening by reading the LibreSSL developer's comment log here, billed as "Tearing apart OpenSSL, one arcane VMS hack at a time."

    .
    It's also one of the funniest developer-centric things I've ever read - no holds barred for these guys in their contempt of the code they're ripping to shreds. Win/win.

  6. Re:I'm gonna FREAK! by Noryungi · · Score: 5, Informative

    Oh, really? A trainwreck?

    Explain this, then: [Source is here]

    The following CVEs were fixed in earlier LibreSSL releases:
                  CVE-2015-0206 - Memory leak handling repeated DLTS records
                  CVE-2014-3510 - Flaw handling DTLS anonymous EC(DH) ciphersuites.

                The following CVEs did not apply to LibreSSL:
                  CVE-2014-3571 - DTLS segmentation fault in dtls1_get_record
                  CVE-2014-3569 - no-ssl3 configuration sets method to NULL
                  CVE-2015-0204 - RSA silently downgrades to EXPORT_RSA

    Let's see... 5 CVE were either fixed in LibreSSL or did not apply to it. That's not too bad for a "trainwreck".

    And what about that little dig at NetBSD? Hmmmm... You mean some people take stuff from OpenBSD and make it less secure? The plot thickens.

    Oh, and by the way, that OpenSSH thingie? Yup, it came from the last "open source" version of SSH, the commercial software. In other words, OpenBSD devs took something already existing and made it better. Hmmm... I think you just don't know what you are talking about...

    Listen, you can find OpenBSD programmers annoying and even call them "masturbating monkeys", but they know their stuff. Period. Calling what they do a "trainwreck" is hyperbole at best and just plain untrue at worst.

    This being said, to get back on topic, auditing OpenSSL is not a bad idea. Far from it.

    --
    The right to offend is far more important than the right not to be offended. (Rowan Atkinson)