Kas Ob.

Also thank you for this link, it is nice reading.

That is perfect, i did the same with SBB, as it was implemented to compare many things and went all the way to validate the chain, so its caching was paranoid, the thing that confused (a little doubt confusion) me in that binary compare is the declaration of x (TX509) and f(ICryptCert) so that compare (in theory) could be just for the the key or something else, hence i preferred to present this to you instead. One thing that is easy to miss: specified curves and implicit curves are allowed in PKIX and X.509 certificates, but such certificate are not allowed to be used with TLS 1.2 ( 1.3 + ), https://datatracker.ietf.org/doc/html/rfc5480#section-2.1.1 That Section 2.1.1 is important and packing few restrictions, you can check (faster than anyone else) for these, since mORMot have full x.509 parser now. Congratulations again !

@Arnaud Bouchez That is awesome indeed !, really nice work. I have one concern about this ( from https://blog.synopse.info/?post/2023/12/09/Native-X.509-and-RSA-Support ) maintaining a cache of ICryptCert instances, which makes a huge performance benefit in the context of a PKI (e.g. you don't need to parse the X.509 binary, or verify the chain of trust each time). This made me try to follow the implementation and this is not easy, so i want to explain form my past counters with such a possible weak point, and i believe you are the one to check if the implementation is prone to such attack, you have the better understanding and the internal work flow. The code in question is this , (well this is mainly from what caught my eyes, but not limited to that , again it is you who should check and decide) The attack i will (try to) explain in details here is was real vulnerability in Chrome and Windows and even in OpenSSL, and concern caching the validation, this sound silly, yet the attack was at the CA of the certificate not the certificate itself, this will allow MITM to replace the certificate at real time. So, the scenario goes like this: 1) Client initiate the handshake with its ClientHello. 2) MITM will pass it without changing to server. 3) Server respond as usual, and in its response the certificate, here by TLS and SSL reference the suggested behavior is to send at least one CA with the certificate, it is recommended to send full chain excluding the root as best practice, this might not be relevant as all what we need is that the MITM to have the CA, so even if the server didn't send the CA, it might be publicly known (like letsencrypt ...) , anyway MITM will pass this records/packets without touching to the client. 4) Client received the secure untouched traffic and validated and the certificate and its CA (this is the important part), the CA is verified and trusted and most likely cached ! 5) Client proceed to establish the handshake procedure, here MITM cut the traffic and drop the connection, forcing the client to reestablish the connection with new handshake, as the TLS resumption ticket or session were not confirmed, this will not help the client/server connection. 6) MITM pass the traffic for this new ClientHello to the server untouched, or can start its own process impersonating the server, for just recording/watching, in that case it must start a connection on its own to the server and that can easily be passed. 7) MITM as a response to the client, will forge new fake CA, and here the attack part, with this new CA that have identical parts (some only, and it could be very easy indeed) to the real CA, then issue a new certificate signed by this FakeCA, here if the client will validate the certificate for everything and will pass, except for the CA, logically !, but if the cache and its access way and due the short time between the validating the real CA and checking against FakeCA, it might pass, hence the FakeCert will be valid for the client. The attack is really about attacking the CA and abusing the caching mechanism, so, about caching and find the CA in the cache, and how to fake it, if the cache does have a bValid boolean (and may be with a time for the last validation check), this attack is possible, how it is possible? , some implementation find them by FingerPrint , or by public key ( SubjectKey), ( on side note faking public key for EC certificates is was easier than you can imagine, unless a named curved is exclusively used, in other word you can choose the the same curve with specific generator point (Gx and Gy) to make any public you need, hence making the FakeCA public key matching the real CA public key, ... So, the point is : Is caching CA prone for similar attacks ? because it will defeat and override all the checking of the server certificate itself. Hope that was clear, and if there is question, please don't hesitate to ask, i would love to explain, ( side note, that code is not easy to track hence i want to explain and i trust you can find weak point if there is any ) Additional source for similar scenario ECC faking like the mentioned above https://research.kudelskisecurity.com/2020/01/15/cve-2020-0601-the-chainoffools-attack-explained-with-poc/ Can't find more resources searching now !, but i remember similar cases were in WolfSSL and OpenSSL (multiple times), in fact it has long history of such. Anyway, you more than qualified and armed to check such cases, this post is merely food for thought or reminder. Ps: there is many RSA implementation miss rare cases and allow such manipulation, like allowing/processing non primes, or one "1" as exponent, allowing public key to be faked....

I've been looking at that - since the DelphiGRPC makes use of it. Down the rabbit hole I go.. Well, i see sgcWebSockets folder there, this means the porting to sgcWebSockets is possible if not easy (or already there), DTLS with 1(or 0) handshake round-trip (with TLS1.3) and HTTP/2 are available, this will should get your attention, for performance and bandwidth utilization.

I can answer that, the stability and responsiveness of the GUI edit (Form Editor) and switching between it unit editor will be visible, this will slow and delay the need to restart IDE to get it responsive. If a project doesn't use DevArt Unidac, then disabling will help, this goes for all the big libraries, and most notably LiveBindings, that thing has its heavy impact on the GUI editor.

Well, i can share their contact, and if that is a problem for Rafael, then let it be, Also you can simply ask them and/or contact their Selling Service (like Digital River in my invoice )and confirm any public info or clear your doubts, it is not like you are violating anyone privacy, just doing your diligence. There was a forum years back and they closed it as it was wasting their time and confusing the clients more than resolving problem, look at EurekaLog they did closed their forum, is their support is trust worthy now ? the answer is nope ! You are judging a book by its cover, and if that have any impact in real world, then Amazon site is the worst designed interface with ugliest/stupidest UI search algorithm you will ever see, this doesn't mean they are not the leaders in their business sector. Now to one of many things that is not mentioned in the site but i am familiar with it, code virtualization and their VMs, One day, in fact one of the old days when i decided to test Winlicense VM engine on my own, i used OllyDbg with custom script, i adjusted and tested that script to work as fast as it can and even dropped valuable information from its logging to speed it, i am doing controlled test and i am looking for already know code, all these i am familiar with, and built a simple application with one VM, inside it a specific code that i will recognize, and wanted to know how hard/easy to analyze WL VM, the chosen VM was one of the smallest and the fastest, the debugger script was to perform step into and log the instructions and the modified register, so i can find my own code, of course disabled most the other protection in WL like allowd debugging ..etc and ran the script right before entering the VM, and the process reached and break point out side the protected code which was three Delphi lines, the process took around 45 minutes, and generated a log with around 300mb in size, also took me hours to pin point the exact place where my 3 lines executes, great and was happy with my finding, now i changed to a heavier VM one of the upper middle in complexity and size but not the most complex or the biggest, and ran the script, the is that i remembered that i have a life to live, and stopped at after 3-4 hours with 3.5 Gb of log file, and there was no evidence that my 3 lines were executed yet. The result was very happy with WL, i know its limit or at least i have an idea, specially my protected projects have something around 3-6 different VMs and code flow must pass at least 10 VM macros before giving the user (or hacker/cracker) any useful place to pin anything useful. in general i use 50 VM macros for these few VM, and if some hacker/cracker want to spend weeks/months to crack it, then let it be, most likely my application will be updated and rendered his work as obsolete, also the way i do it, he might be successful but this will work for one PC, his own PC and that is worst scenario for me. These VM run at full speed and they have an impact on the application performance even the heaviest my take up to a second, but with care you can minimize that impact and at least hide that effect from the application user. Hope that helps. Edit the invoice now doesn't have full address.

Of course they are dead slow. I would suggest to build your own class that handle drawing a a single text string on its own small BMP (sized according to the text and the font), so there texts strings will have their own BMP that will invalidate only when you change the text, and simple draw procedure needing canvas and coordinates ( and may be a rect for clipping if needed), this what i do and this will make things faster enough for drawing on your own BMP or directly on the needed canvas.

Windows has a specific infrastructure and interface to recognize standardized cryptographic service providers (CSP), it will initialize its own driver to communicate with it, notice that, USB specification has its own interface standard, meaning, an USB device can introduce itself to the host device as it designed to, (trying to simplify and yet it is sound bla bla bla, so sorry) Let try again, a USB may be a keyboard and a soundcard and mp3 player at the same time in compliant with Windows default driver and also have thermostat ability but for this one you need the manufacturer driver, so what ever you USB hardware is or manufacturer was it might use the default Windows compliant driver with CSP interface ! USB (Universal Serial Bus) in fact is standard hardware communication protocol, and that it is, USB device can declare itself anything, and it can multiple devices with literally no limit to how many protocols or devices it can handle, impersonate, provide functionality to. Fun fact: my android mobile is rooted, and i installed a Magisk module that allowed me to to boot my PC from the mobile using my Acronis ISO file, it booted beautifully ! Also you may have came across these 3G/4G USB modems where acted like read only (or readwrite) disk drive with the drivers for their custom modem, so plug them and an autorun will kick in the offer to install the modem driver if it is not present, if the driver is there it will run its modem UI. So returning to the Microsoft CSP, a Windows compliant hardware token will be recognized and the driver will interact with it in standardized way, get the certificate(s) and manage the private key operation knowing it is there and unexportable and it is the device job to perform specific operation and get the result. to read more https://learn.microsoft.com/en-us/windows/win32/seccrypto/csps-and-the-cryptography-process also this is more details on the design https://learn.microsoft.com/en-us/windows/win32/seccrypto/cryptoapi-system-architecture Hope that help and explain few things, and sorry for the English too.

That is correct behavior. See, even Windows OS while loads and unload all the needed libraries (DLL) for application and their dependencies too, require explicit call to FreeLibrary if you called LoadLibrary on your own https://learn.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-freelibrary So the shortcoming from the RTL management from not reference counting the libraries from the manual load, i think it is a bless and prevent many hidden bugs and memory leaks, in other words you load it, you unload it.

A question may me a little off topic Did anyone tried https://www.nsoftware.com/pkiproxy ?

Me too like Angus, don't see this as thing from the past, on contrary i think it is the future and the only way forward with all new security measures the world need now. PKCS#12/pfx is highly customizable format, securely design and very extendable, it can encapsulate PKCS#7 and PKCS#8 and most (usable part) of PKCS#5, as example PKCS#12 can hold a certificate/token to decrypt another PKCS#12, in my opinion this what should have been done with Code Signing Certificates, the issuer should have issued i hardware token for the client that passed their verification, then after that issued the certificate in PKCS#12 (as simple file) to be decrypted by that hardware key, that is way easier to use the encrypted certificate that can be handled in all your infrastructure safely, also there can be multiple token to decrypt the same certificate, also another important thing i see gaining necessity, the need to cross singing but more than one certificate, PKCS#12 allow that, also something like two people have to use their hardware security card to allow the singing, and all in standardized and vetted procedure.

That is SEH, a normal SEH, has nothing to do with SafeSEH from Windows OS. The resources about it are scarce but here a pointer https://stackoverflow.com/questions/25081033/what-safesehno-option-actually-do For SafeSEH you need the compiler and the linker to jointly produce Windows SafeSEH compliant structure. This will not help too, it will only make the OS more aggressive against your application with near zero tolerance for page faults. Code Flow Guard (CFG) is very similar to SafeSEH from https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/exploit-protection-reference?view=o365-worldwide#control-flow-guard-cfg Hope that clear things.

To my knowledge, Delphi compiler doesn't support both, both are specific structures and code snippets generated by the compiler to help Windows OS, where the compiler must add specific structures/procedures in the code (and data/heap/stack) in very specific way to help the OS monitor intrusions or malicious interventions But i can be mistaken and Delphi compiler is already doing that, (highly unlikely!)

That is pretty fucking neat ! and impressive ! The only thing is missing there is the ability to create CSR https://en.wikipedia.org/wiki/Certificate_signing_request or what i miss the most, the ability to create CSR from a certificate, this is very helpful when want extend your certificate with the same extensions and/or the same private key, very helpful with ACME and with code signing requests, not sure about the new modern model for code signing delivery though.

First i suggest to make sure to understand the difference between formats so pfx and p12 are "almost" the same, but sure in 2023 should be the same, both are PKCS#12 https://en.wikipedia.org/wiki/PKCS_12 cer and der are more or less the same and they are PKCS#7 https://stackoverflow.com/questions/22743415/what-are-the-differences-between-pem-cer-and-der#22743616 https://en.wikipedia.org/wiki/PKCS_7 now after all that "may be" and "more and less", i highly recommend to use xca from https://hohnstaedt.de/xca/ this tool in my opinion is a must have to store and manage your certificates and private keys, it is portable and its DB is very secure, get familiar with it, and store your certificates there, but the most useful functionality is the ability to export what you have created or stored there, you have all the formats and many ways to export like protected with password or not, or with full chain or part of the chain ... Very useful tool in case you don't have the time to search the net and use OpenSSL commands that is hard to remember, also easier and safer than storing your certificates in Windows Store (the certificate store), which might be useful in your case also, if you want an alternative to OpenSSL or xca, import using Windows Explorer double click then find it in certmgr (from run command), just remember that certmgr will open for current user, while running mmc (the console) then select "Add or Remove Snap-in" from there you can add Certificates which will allow to access Current User and Service Account and Computer Account, here Account used for Certificate Store, from there you can add/import and export any certificate (but always with private keys if the certificate was imported with non exportable key), also with less formats selection than XCA. Hope that helps, and good luck !

Thank you for answering and clearing that. This Demo you pointed to works fine and does connect as expected. But the standalone "Protocol Discord Demo" from https://www.esegece.com/websockets/apis/other-apis/discord is not working, just freezes, and that made me ask, next questions will be on your forum.

@esegece Question I received an offer few hours ago for special Discord bot, that will handle delivering trial/limited software to users, from what i see esegece WebSocket provide API for discord, but i have no idea where to start with Discord, though tried your Telegram demo, and it worked way better than my expectation, in fact in less 3 minutes i had a Telegram bot sending and receiving messages and files, this gave me goosebumps, but discord demo i can't find how or where or where to start, so i want to ask your opinion about a comparison Discord bot developing vs Telegram Bot, is there road bumps in making similar functionality with such ease for Discord like Telegram ? is there a pointer(s) on how to make Discord demo work ? My question is that i need to put a time frame for that offer, if it doable then sure the project will provide me with financial justification to buy a license.

This has nothing to do with Delphi, in fact this behavior is observed with every software do animation when used with RDP (RDS) the problem is simple, RDP screen core process will detect screen changes at some intervals, then send these parts, so it goes from full screen update to small part, these animation happens at high frame rate, so either RDP didn't capture the changes because it fall in between its frame capturing time and it did look like was minimum change and not worth updating, or due the high change rate the RDP throttled the update and skipped updating these parts. Recommendation : if possible detect RDP session (RDS as you called it) and disable all animation, this will enhance the fps and prevent what seems like wrong rendering, also if you have shadows, blurring and gradient colors then disabling them will enhance the speed a lot and require less traffic due the smaller images with higher compression without losing quality.

I don't think it is needed now to separate this thread, and yes we are off the original topic. Still getting to know this gem, now debugging is working, it is somehow big library to get the ins/outs, it is just different and i might think of few additions and adjustments, but all in its time. My question about throttling was due some strange behavior, didn't find yet, but demo09 was throttled and it was visible, demo04 yesterday did something similar but after running many test drives and breaks many things, today i can't repeat it even with the same files, there was some slowness in uploading, demo proto still fail with big files (more than 2.3mb) but not fail with exception just the connection timeout at 30s with my PC and Chrome, also don't think it is huge deal, most important thing is that demos are there and working to tweak, love whole idea of this approach with xxm. Mostly i love the file handling and websocket and the lightness and conciseness of everything around this xxm, it gives more power and control than scripting.

And yes compiling on demand is running flawlessly, it is beautiful, short and fast. Congratulations on this piece of gem and thank you ! ps it is astonishing, the difference between your files which Delphi 7 and the one generated on mine, ten times the size ! (94kb vs 960kb)

Thank you, now things running ! One thing though, the xxmProject.exe still refusing to run, it does crash, even when i tried the one from the binaries package it does allowed to select the web file then crash. From the xxmProject.exe in the Demo package Not really a problem but if the path to the demo (web project) has a space then the compilation fail Tried playing around and i am liking this, one thing though will have time for it later to dig in, the uploading file is slow like it is being throttled, is it ?

I get the jest of that, but i can still serve static files with/without my own scripting , right ? That why i need to see some action, some clients love to feel like hackers by providing them with some sort of tweaking and adjusting stuff, like building their own SQL query and have the ability to add button for that then adjust the colors of the columns ...etc That literally what i want to hear and read, not to be forced to use others implementation of exception handling and have full control over it.

That will not work, your finally is missing a try before hand and an end afterward.

Don't know about Peganza Expert, i have an old expired Peganza Analyzer, but if the Expert have 1/5 of the Analyzer features, then it is x10 time than anything else, i mean anything and all, it should be part of the IDE decades ago.

I suggest/request to add a new download package at http://yoy.be/xxm/download.html , just one binary xxmHttpDev (or xxmHttp) but with full working demos, working out of the box, no interaction needed, something to show the functionality without any setup or tweak. User or potential users need to see the power of running web server effect in one single click (with xxm features), and the portability of paths and the whole setup, it is important.