Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:69244
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.182 as permitted sender)
MIME-Version: 1.0
Sender: tjerk.meesters@gmail.com
In-Reply-To: <000001ceb53c$492a3090$db7e91b0$@org>
References: <CAH8MpnnTGD0xAwG1j9sh10EC6XzdscVRLbJzEMG6qWSBK5c17w@mail.gmail.com>
	<523A466C.4070903@gmail.com>
	<CAHMUw2HxcWgOBxiK=r4y6FgWF_Gkhgc6BgHxF_bgLLJG9RVxmQ@mail.gmail.com>
	<CAEZPtU7YjNksHLEyH9VzM-iDdpQmBeJkF-BHPkAajZjiQS5XBA@mail.gmail.com>
	<CAHMUw2Gv=JdswmWVHCvp2S3WECVPEx4aWOQzF2yLMHaqJ5HK-g@mail.gmail.com>
	<000001ceb53c$492a3090$db7e91b0$@org>
Date: Fri, 20 Sep 2013 15:24:19 +0800
Message-ID: <CAHMUw2ECV2KnwgtoKEwqB5b6Y4M_SM0NKCZK3eMVWoDp2Gemdw@mail.gmail.com>
To: "Bryan C. Geraghty" <bryan@ravensight.org>
Cc: Pierre Joye <pierre.php@gmail.com>, johannes@schlueters.dot.de, addw@phcomp.dot.co.uk, 
	Daniel Lowrey <rdlowrey@gmail.com>, PHP Internals <internals@lists.php.net>, 
	=?ISO-8859-1?Q?=C1ngel_Gonz=E1lez?= <keisial@gmail.com>
Content-Type: multipart/alternative; boundary=089e01536b7c0757d204e6cb8fd5
Subject: Re: [PHP-DEV] Re: Re: PHP Crypt functions - security audit
From: datibbaw@php.net (Tjerk Anne Meesters)

--089e01536b7c0757d204e6cb8fd5
Content-Type: text/plain; charset=ISO-8859-1

Hi Bryan,

On Thu, Sep 19, 2013 at 9:29 PM, Bryan C. Geraghty <bryan@ravensight.org>wrote:

> -----Original Message-----
> From: tjerk.meesters@gmail.com [mailto:tjerk.meesters@gmail.com] On Behalf
> Of Tjerk Anne Meesters
> Sent: Thursday, September 19, 2013 4:01 AM
>
> > My point is that you need a reasonably up-to-date certs bundle to enable
> verification by default.
>
> Actually, you don't. There is no reason why certificate validation cannot
> be
> enabled by default without a CA bundle. Yes, verifications will fail by
> default but this is no different than the cases where someone has an
> oddball
> provider or self-signed certificates; they have to manually add the cert
> for
> verification to pass.
>

For the most part, API libraries I've seen handle this scenario by shipping
a certificate bundle with their code. The verification setting obviously
does not apply to them, because they're handling it themselves or they
don't use streams at all.

However, I can imagine the bulk of developers will want the
`file_get_contents('https://example.org')` to *just work* and flipping that
switch between versions will likely upset a horde of them.


>
> Additionally, given the current certificate climate, I wouldn't trust
> anything signed by the global CAs. If you're concerned about security, you
> should be validating the certificate fingerprint and not trusting CAs.
>

That feature is currently not very well supported in streams. However, I'm
working on a proposal to introduce [openssl_x509_digest()] which would make
this possible:

$context = stream_context_create([
    'ssl' => [
        'capture_peer_cert' => true,
]]);

$f = fopen($url, 'rt', false, $context);

$options = stream_context_get_options($context);

openssl_x509_digest($options['ssl']['peer_certificate'], $result);
echo "SHA1 fingerprint = ", bin2hex($result), "\n";

https://github.com/datibbaw/php-src/commit/b8f9a20286c6d88c11e81967df42d118bdba2f02




>
> Bryan
>
>


-- 
--
Tjerk

--089e01536b7c0757d204e6cb8fd5--