What are the security ramifications of TLS in kernel versus in user space like FreeBSD 13.0 is doing? (why do the other *BSDs not want it?) reddit / BSD ---------------------------------------------------------------------- kyleW_ne · 2021-04-13 06:37 I was recently really excited to read about the speedups for web servers running FreeBSD 13.0 that make use of TLS encryption. It sounds so exciting! Having TLS in the kernel makes sense since the processors have cryptographic accelerators in them nowadays. I made a post on /r/openbsd about if we could expect to see TLS in the kernel in OpenBSD 7.0 this fall and was promptly shot down by a developer. Is there a security trade off for having TLS in the kernel in an operating system? Why wouldn't all the *BSDs want to copy FreeBSD's move here? I know how to program but have never done any crypto programing so am honestly just curious why all four major BSDs wouldn't want this! ---------------------------------------------------------------------- mickywickyftw · 2021-04-13 07:04 My first thought is that any security hole in the TLS implementation becomes a kernel security hole. That doesn't sound good at all as it could be exploited remotely. ---------------------------------------------------------------------- kyleW_ne · 2021-04-13 07:11 I had not thought of that. This video https://www.youtube.com/watch?v=Qc0QRdxVv3g shows how it is implemented. I guess if a webpage was put together just right you could get something like sql injection but for the kernel! That would be very bad having the kernel execute arbitrary code! ---------------------------------------------------------------------- teresko · 2021-04-13 07:11 You have to remember that each of "the big three" has a different philosophy. ---------------------------------------------------------------------- LousyMeatStew · 2021-04-13 07:24 I think the biggest mistake here is in assuming that what makes a particular design decision great for one BSD will necessarily be great for all BSDs. Each of the BSDs have different goals. NetBSD, for example, focuses on portability so this wouldn't be a good idea as they target lots of platforms that don't have crypto acceleration. For OpenBSD, they've done a lot of work to achieve precisely the opposite of this, which is to keep things out of the kernel except for stuff that absolutely has to be there. This is in line with OpenBSD's goals which are for correctness and proactive security and specifically, not for performance. As for what security ramifications there may be, /u/mickywickyftw pretty much hit the nail on the head. Bear in mind that the OpenBSD project is behind the LibreSSL project so they know first hand from looking at the OpenSSL code what a mess this could ultimately become and I can't imagine anyone who went through that process would ever think to themselves "you know what would be great, tho? If this were all in kernel space." Not suggesting that FreeBSD's efforts amount to putting OpenSSL into the kernel - I honestly don't know any details about it. And I'm sure there's a performance boost but that's in line with FreeBSD's general goal of being the most "optimized" BSD in terms of performance. Perhaps the real answer here is that if FreeBSD wants to be the first to do it, let them do it and let's take some time to assess whether that ultimately is a good idea or not. ---------------------------------------------------------------------- gnemmi · 2021-04-13 10:07 Not to be a prick but that would be four .. "the big four" have a different philosophy .. ---------------------------------------------------------------------- teresko · 2021-04-13 10:09 Hmm ... the fourth being TrueOS or DragonflyBSD? ---------------------------------------------------------------------- gnemmi · 2021-04-13 10:20 DragonFly BSD. TrueOS never was a BSD system in its own right .. it was just a server-oriented OS (as opposed to its predecessor PCBSD wich was deaktop oriented) built upon the most recent releases of FreeBSD-CURRENT, and has actually been discontinued afaik ---------------------------------------------------------------------- mobani · 2021-04-13 10:46 This seems like somebody is trying to fix a problem that don't exist. Since when is it considered a huge load to run TLS outside of the kernel? ---------------------------------------------------------------------- _arthur_ · 2021-04-13 11:10 > I guess if a webpage was put together just right you could get something like sql injection but for the kernel! That's not particularly accurate. The TLS-in-kernel implementation really only handles the encryption. The most complex bits of setting up the TLS connection (certificate validation, key negotiation) is still handled in userspace. Only once the shared key has been computed does the kernel take over. Edit: There's a considerably more in-depth video about it here: https://www.youtube.com/watch?v=la-ljVavd3c by one of the people who did the work. Edit2: Glaring typo fix. ---------------------------------------------------------------------- _arthur_ · 2021-04-13 11:12 It's a relatively niche problem, yes. For the vast majority of users doing everything in userspace is just fine. However, this work was done by Netflix, and at the speeds they're pushing you do actually want this, because it lets you avoid a lot over copying overhead (between kernel and userspace). Their OpenConnect appliances push a **lot** of traffic. ---------------------------------------------------------------------- mobani · 2021-04-13 12:25 Not sure why Netflix keeps using resources on encryption of their streams anyway. Its not like their shows are ripped in the transmission level? ---------------------------------------------------------------------- daemonpenguin · 2021-04-13 12:32 TrueOS is based on on Void, a Linux distribution. ---------------------------------------------------------------------- _arthur_ · 2021-04-13 12:51 My own personal theory (very much not based on anything said by Netflix) is that it's more about hiding what content is popular from ISPs than about copy protection. ---------------------------------------------------------------------- wfaulk · 2021-04-13 13:01 Trident is based on Void, not TrueOS itself. TrueOS has been discontinued, though. ---------------------------------------------------------------------- mobani · 2021-04-13 13:37 I see, that actually makes sense! Thanks! ---------------------------------------------------------------------- teresko · 2021-04-13 13:54 Ah, I assumed that TrueOS was just a re-branding of PCBSD. ---------------------------------------------------------------------- [deleted] · 2021-04-13 14:15 [deleted] ---------------------------------------------------------------------- kyleW_ne · 2021-04-13 14:58 Thank you for the video! ---------------------------------------------------------------------- BumpitySnook · 2021-04-13 15:45 SQL injection has nothing to do with the TLS layer -- you could have that on a non-TLS connection. It would be a bug in the application. No one is calling for kernel-mode webservers these days. ---------------------------------------------------------------------- LousyMeatStew · 2021-04-13 16:27 Bear in mind too that trying to enumerate specific threats is, from the perspective of OpenBSD's design philosophy, missing the point. There are a lot of practical implications that aren't typically thought of as "security threats" but nonetheless impact a team's ability to develop secure software. Fundamentally, the OpenBSD project does prioritize code correctness and thorough code review. This holds particularly true for the kernel. More code in the kernel is, at the end of the day, more code to review, more code that could conflict with existing code, more code that could contribute to unintended errors and consequences. For a similar example, OpenBSD chose not to incorporate ZFS support (https://flak.tedunangst.com/post/ZFS-on-OpenBSD). Not only that, but OpenBSD supports platforms that don't support crypto acceleration - i386, alpha, macppc, etc. So not only are you talking about adding kernel support, you're talking about adding the extra plumbing necessary to ensure that the kernel compiles correctly on platforms without hardware crypto support and even then, you're left with crypto routines that behave differently on different platforms, making testing that much more difficult. FreeBSD, OTOH, only considers x86-64 and ARMv8 (the two platforms that do support hardware crypto) to be Tier 1 as of v13 (https://www.freebsd.org/platforms/). ---------------------------------------------------------------------- masta · 2021-04-13 17:45 I dunno, back in the 90's we had people embedding web servers in the freebsd kernel, warts and all. Sure it was fast, but it wasn't very secure. ---------------------------------------------------------------------- fragbot2 · 2021-04-15 14:45 Encryption at rest and in transit might be a contractual requirement with their content providers.