View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0005972 | Taler | libeufin-nexus | public | 2019-11-18 18:28 | 2026-09-19 14:44 |
| Reporter | Marcello Stanisci | Assigned To | Antoine A | Resolution deadline | |
| Implementer | Reviewer | ||||
| Release signed by | Deployed by | ||||
| Verifier | Communicator | ||||
| Data protection authority notification required | No | ||||
| CSIRT notification required | No | ||||
| Estimated effort (hours) | Actual effort (hours) | 0 | |||
| Fast-track | No | ||||
| Work package | none | ||||
| Priority | normal | Severity | minor | Reproducibility | have not tried |
| Status | informing | Resolution | fixed | ||
| Target Version | 1.6 | Fixed in Version | 1.6 | ||
| Summary | 0005972: Avoid sending signed data before key exchange | ||||
| Description | The Nexus should check if their keys were accepted by the bank (via INI / HIA) before performing any operation using those. This is useful because some banks may simply respond "signature invalid" without telling what the real cause is. | ||||
| Tags | No tags attached. | ||||
| This happens here (1) for example, where the 'makeEbicsHpbRequest()' function just makes the message without checking the state of the key used to sign the message. But possibly, this is not a real problem. If errors are nicely reported, then the user will be correctly warned about the impossibility of the attempted operation. [1] https://git.taler.net/libeufin.git/tree/nexus/src/main/kotlin/tech/libeufin/nexus/Main.kt?id=4f0af79c3cde2b71f8a3607d5310aaf375d011eb#n87 | |
| This can be closed after testing how Postfinance reacts to such scenario, but using keys that were never shared with the bank should be avoided. | |
| With the current libeufin-nexus, this is obsolete. | |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2019-11-18 18:28 | Marcello Stanisci | New Issue | |
| 2020-05-15 17:19 | Marcello Stanisci | Note Added: 0015917 | |
| 2020-05-15 17:19 | Marcello Stanisci | Assigned To | => Marcello Stanisci |
| 2020-05-15 17:19 | Marcello Stanisci | Status | new => feedback |
| 2020-11-10 11:07 | MS | Target Version | => 0.9.2 |
| 2020-11-10 15:26 | MS | Target Version | 0.9.2 => 0.9.3 |
| 2023-04-11 09:14 | MS | Note Added: 0020067 | |
| 2023-04-11 09:22 | MS | Note Edited: 0020067 | |
| 2023-04-11 09:24 | MS | Status | feedback => assigned |
| 2023-04-11 09:25 | MS | Status | assigned => acknowledged |
| 2023-04-13 18:26 | Florian Dold | Project | libeufin => Taler |
| 2023-04-13 18:26 | Florian Dold | Category | nexus => General |
| 2023-04-13 19:31 | Florian Dold | Category | General => libeufin-nexus |
| 2023-06-29 10:07 | MS | Target Version | 0.9.3 => post-1.0 |
| 2023-09-03 16:23 | Christian Grothoff | Assigned To | Marcello Stanisci => MS |
| 2023-12-23 16:02 | Christian Grothoff | Assigned To | MS => |
| 2026-08-27 06:55 | Florian Dold | Assigned To | => Antoine A |
| 2026-08-27 06:55 | Florian Dold | Status | acknowledged => informing |
| 2026-08-27 06:55 | Florian Dold | Resolution | open => fixed |
| 2026-08-27 06:55 | Florian Dold | Note Added: 0029601 | |
| 2026-09-19 14:40 | Christian Grothoff | Fixed in Version | => 1.6 |
| 2026-09-19 14:44 | Christian Grothoff | Target Version | post-1.0 => 1.6 |