E03-CG: Pending
Rationale
The pinned HDTN candidate has an explicit outgoing TLS 1.3 selector: useTlsVersion1_3 chooses tlsv13_client when BOOST_VERSION >= 106900. Older builds log a warning and use TLS 1.2 instead. With certificate verification enabled, the outduct loads local CA material, requires peer verification, and checks the configured next-hop EID against id-on-bundleEID (OID 1.3.6.1.5.5.7.8.11); the code also accepts the older URI SAN form. Session initialization separately compares the remote EID with the configured next hop. These close the source-location questions for outgoing version selection and next-hop binding, not complete-profile qualification.
Assessment method
Source-path and configuration review; no build or runtime execution
Source context
Version-pinned HDTN outduct, induct and TCPCL session code
Outstanding qualification
Candidate configuration must enable tryUseTls, tlsIsRequired, useTlsVersion1_3, doX509CertificateVerification and verifySubjectAltNameInX509Certificate, with compatible Boost/OpenSSL and locally supplied trust. The inspected induct configures its server certificate/key and supports TLS 1.2/1.3, but does not configure the corresponding client-certificate verification path; trace and test reciprocal NODE-ID authentication rather than treating session EID parsing as proof. The verification callback checks SANs on each invoked chain certificate, without an explicit leaf-depth condition in this function; qualify the intended local CA chain instead of assuming arbitrary chains work. Test version negotiation, wrong EID, untrusted and missing certificates and no-TLS rejection. Preserve the round 2.83 ION adapter gap. Complete BPSec primary/payload and native delivery-policy mapping remains; CG additionally requires SABR metadata/custody mapping. No wire execution, exploit, universal implementation failure or profile downgrade is claimed.
Public sources
- https://github.com/nasa/HDTN/blob/7fbe90cdbe3c8c737efaacb5985f881f95fc7d2a/common/outduct_manager/src/TcpclV4Outduct.cpp
- https://github.com/nasa/HDTN/blob/7fbe90cdbe3c8c737efaacb5985f881f95fc7d2a/common/induct_manager/src/TcpclV4Induct.cpp
- https://github.com/nasa/HDTN/blob/7fbe90cdbe3c8c737efaacb5985f881f95fc7d2a/common/tcpcl/src/TcpclV4BidirectionalLink.cpp
Editorial evidence references
The following identifiers refer to research records not included in this public package; they are not public links.
- round284-sources.json
- round283.html