The OSTIF and Quarkslab Audit of OpenSSL is Complete

guest · Jan 24, 2019

The OSTIF and Quarkslab Audit of OpenSSL is Complete
January 21, 2019
https://ostif.org/the-ostif-and-quarkslab-audit-of-openssl-is-complete/

The quick and dirty:
OpenSSL version 1.1.1 was evaluated with special foci on new TLS 1.3 features and changes made to the Pseudo Random Number Generator (PRNG). The PRNG review was conducted by Dr JP Aumasson and Antony Vennard with a follow-up review by the QuarksLab team. The general review was for all new code in OpenSSL 1.1.1 with a focus on TLS 1.3 and the changed PRNG.

QuarksLab found a number of small issues, all of which were resolved before the public release of OpenSSL version 1.1.1. Issues one and two would have led to client-side denial-of-service vulnerabilities, where a malicious man-in-the-middle could cause OpenSSL to crash by sending invalid information.
Click to expand...

Conclusion
OpenSSL has successfully transitioned to TLS 1.3 without any serious security problems that we’ve found. The code quality and comments could stand to be improved in areas, but the code is functional, secure, and fast. The OpenSSL security team was fantastic throughout the entire process, assisting us with questions and quickly responding to concerns that were raised as we found them.

Our work on OpenSSL has led to a total of 16 recommendations and changes in OpenSSL, and we will be adding OpenSSL to our bug bounty program for version 1.1.1a and later through our partnership with the Internet Bug Bounty on HackerOne.
Click to expand...

OpenSSL Security Assessment - Technical Report (PDF): https://ostif.org/wp-content/uploads/2019/01/18-04-720-REP_v1.2.pdf

Log in or Sign up

The OSTIF and Quarkslab Audit of OpenSSL is Complete

guest Guest

Log in or Sign up

The OSTIF and Quarkslab Audit of OpenSSL is Complete

guest Guest

Useful Searches