[openssl-dev] [openssl.org #3908] Patch fixing some heartbeat issues (vs latest git master)

[Peter Dettman]

On 13/06/2015 8:43 pm, Hanno Böck wrote:
> Serious question: Is there any valid use case for heartbeats in TLS or
> DTLS?
> (With valid use case I mean something like "I use it for this system",
> not answers like "you could use it for xy")
I don't use them for anything. We started to implement them for 
BouncyCastle (D)TLS before heartbleed, but I can't see us ever actually 
finishing that, and none of our users has ever asked for them.

> I asked this question in the heartbleed aftermath a couple of times and
> never got any reasonable answer. I have the feeling the only reason
> this extension exists is that someone needed a topic for his thesis.
I'm more cynical and suspect heartbeats to have been designed to 
complement the Dual EC exploitation outlined at 
https://projectbullrun.org/dual-ec/index.html as a possible source of 
attacker-visible PRNG output (quite separate to whatever suspicions 
arise from Heartbleed itself).

>
> If this extension isn't used then I think it shouldn't be fixed. It
> should be removed. I think complexity is responsible for a large chunk
> of the problems TLS has these days, therefore everything that can be
> removed should be.
No objections here, although I'd prefer to see the patch applied before 
any removal, since others may take it upon themselves to keep or copy 
the code.

Regards,
Pete Dettman