a blog

Info: German content only, sorry. I was pondering for the past three years if I should give some sort of TLS basics talk at FrOSCon. I finally stepped up this year and gave that talk today, with the title "TLS, mTLS, SNI, ECH, CAA, HTTPS, PKI, Zertifikate und ein bisschen PQC". I was too optimistic with my 50 slides, and had to drop the Post Quantum Cryptography part at the end. Still got positive feedback from Zugschlus and others - thanks a lot for that <3 - and was asked for the slides. It's…

As an opportunity to rewire my brain from "docker" to "podman" and "buildah" I started to create an image build with an ECH enabled curl at https://gitlab.com/hoexter/ech. Not sure if it helps anyone, but setup should be like this: git clone https://gitlab.com/hoexter-experiments/ech cd ech buildah build --layers -f Dockerfile -t echtest podman run -ti echtest /usr/local/bin/curl \ --ech true --doh-url https://one.one.one.one/dns-query \ https://crypto.cloudflare.com/cdn-cgi/trace.cgi f...

Now that ECH is standardized I started to look into it to understand what's coming. While generally desirable to not leak the SNI information, I'm not sure if it will ever make it to the masses of (web)servers outside of big CDNs. Beside of the extension of the TLS protocol to have an inner and outer ClientHello, you also need (frequent) updates to your HTTPS/SVCB DNS records. The idea is to rotate the key quickly, the OpenSSL APIs document talks about hourly rotation. Which means you've to…

If you want the latest pflogsumm release form unstable on your Debian trixie/stable mailserver you've to rely on pining (Hint for the future: Starting with apt 3.1 there is a new Include and Exclude option for your sources.list). For trixie you've to use e.g.: $ cat /etc/apt/sources.list.d/unstable.sources Types: deb URIs: http://deb.debian.org/debian Suites: unstable Components: main #This will work with apt 3.1 or later: #Include: pflogsumm Signed-By:…