Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

proposal: crypto/tls: new option for mTLS servers to not advertise acceptable certificate_authorities #59825

Open
irsl opened this issue Apr 25, 2023 · 1 comment
Labels
Proposal Proposal-Crypto Proposal related to crypto packages or other security issues
Milestone

Comments

@irsl
Copy link
Contributor

irsl commented Apr 25, 2023

Problem

A Golang mTLS server includes a list of Distinguished Names of acceptable CAs in the TLS handshake. In some threat models, the name of the CAs the server accepts may represent an information leak. Especially, if the CA is use-case specific and contains information about the customer; like this example from the Google space: https://buganizer.corp.google.com/issues/187209748

Currently, the tls/crypto package does not provide a way to not populate certificate_authorities, even though it is not mandatory part of the handshake.

Solution

This could be addressed by adding a new boolean field (something like DontAdvertiseClientCAs bool) in tls.Config to disable this behavior optionally.
Servers that prefer not advertising the CA names could opt-out by flipping this new setting.

@irsl irsl added the Proposal label Apr 25, 2023
@gopherbot gopherbot added this to the Proposal milestone Apr 25, 2023
@seankhliao seankhliao added the Proposal-Crypto Proposal related to crypto packages or other security issues label Apr 25, 2023
@seankhliao
Copy link
Member

cc @golang/security

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Proposal Proposal-Crypto Proposal related to crypto packages or other security issues
Projects
Status: Incoming
Development

No branches or pull requests

3 participants