ssl module incorrectly supports tls-unique channel binding for TLS 1.3

Open
#95,341 12 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
45/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
c, python
Domain
security

Research direction

Start with Lib/test/test_ssl.py around lines 671-681 and the get_channel_binding implementation in Modules/_ssl.c around line 2705. Read RFC 8446 Appendix C.5 and RFC 9266 to confirm the TLS 1.3 binding requirements. Done means the TLS 1.3 behavior and its tests no longer treat tls-unique as supported and reflect the defined replacement.

Written by the indexing model from the issue text.

Description

topic-SSL type-bug type-security

CPython's get_channel_binding method implements the tls-unique channel binding for TLS 1.3:
https://github.com/python/cpython/blob/main/Lib/test/test_ssl.py#L671-L681
https://github.com/python/cpython/blob/main/Modules/_ssl.c#L2705

But this is incorrect. tls-unique is vulnerable to a couple of attacks (3SHAKE, SLOTH), so it was left undefined in TLS 1.3. RFC 9266 defines a replacement tls-exporter binding, built with Export Keying Material instead.

Dominant language
Python
Stars
77.2k
Forks
36k
Avg merge
1d 9h
Merged PRs (30d)
558

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from python/cpython

All issues in python/cpython

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.