taskWeeChat - Tasks: task #10106, Allow configurable TLS priorities...

 
 

task #10106: Allow configurable TLS priorities or hardcode the use of SECURE256 priority

Submitted by:  bazerka <bazerka>
Submitted on:  Mon 18 Jan 2010 10:38:46 PM UTC  
 
Category:  irc plugin Should Start On:  Mon 18 Jan 2010 12:00:00 AM UTC
Should be Finished on:  Mon 18 Jan 2010 12:00:00 AM UTC Priority:  5 - Normal
Status:  Done Privacy:  Public
Percent Complete:  100% Assigned to:  Sebastien Helleu <flashcode>
Originator Name:  Open/Closed:  Closed
Planned Release:  0.3.5 IRC nick:  Bazerka

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Thu 28 Apr 2011 10:59:26 AM UTC, comment #1:

Done with option "ssl_priorities" in IRC servers.

Sebastien Helleu <flashcode>
Project AdministratorIn charge of this item.
Mon 18 Jan 2010 10:38:46 PM UTC, original submission:

At present, TLS priorities are hardcoded to specify a preference list of protocols only.

Due to this, 128bit ciphersuites are appearing in the ciphersuite list prior to their 256bit counterparts and hence, will always be used in preference.

I suggest either allowing the priority string to be user configurable, or hardcoding the priority to include SECURE256 as well as the protocol, so that the available cipersuite list is sorted from strongest to weakest (ie, 256bit ciphersuites are listed before the 128bit variants).

For example,

gnutls-cli connecting to an ssl ircd without --priority SECURE256 shows :

|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_RSA_AES_128_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_RSA_AES_256_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_RSA_3DES_EDE_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_DSS_AES_128_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_DSS_AES_256_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_DSS_3DES_EDE_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_DSS_ARCFOUR_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_PSK_SHA_AES_128_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_PSK_SHA_AES_256_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_PSK_SHA_3DES_EDE_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_PSK_SHA_ARCFOUR_SHA1
|<3>| HSK[0x801236000]: Removing ciphersuite: SRP_SHA_RSA_AES_128_CBC_SHA1
|<3>| HSK[0x801236000]: Removing ciphersuite: SRP_SHA_RSA_AES_256_CBC_SHA1
|<3>| HSK[0x801236000]: Removing ciphersuite: SRP_SHA_RSA_3DES_EDE_CBC_SHA1
|<3>| HSK[0x801236000]: Removing ciphersuite: SRP_SHA_DSS_AES_128_CBC_SHA1
|<3>| HSK[0x801236000]: Removing ciphersuite: SRP_SHA_DSS_AES_256_CBC_SHA1
|<3>| HSK[0x801236000]: Removing ciphersuite: SRP_SHA_DSS_3DES_EDE_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: RSA_AES_128_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: RSA_AES_256_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: RSA_3DES_EDE_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: RSA_ARCFOUR_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: RSA_ARCFOUR_MD5
|<3>| HSK[0x801236000]: Keeping ciphersuite: PSK_SHA_AES_128_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: PSK_SHA_AES_256_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: PSK_SHA_3DES_EDE_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: PSK_SHA_ARCFOUR_SHA1
|<3>| HSK[0x801236000]: Removing ciphersuite: SRP_SHA_AES_128_CBC_SHA1
|<3>| HSK[0x801236000]: Removing ciphersuite: SRP_SHA_AES_256_CBC_SHA1
|<3>| HSK[0x801236000]: Removing ciphersuite: SRP_SHA_3DES_EDE_CBC_SHA1
[SNIP]
- Version: TLS1.1
- Key Exchange: DHE-RSA
- Cipher: AES-128-CBC
- MAC: SHA1
- Compression: NULL
- Handshake was completed

Connecting to the same ircd with --priority SECURE256 shows:

|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_RSA_AES_256_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_RSA_AES_128_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_RSA_3DES_EDE_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_DSS_AES_256_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_DSS_AES_128_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_DSS_3DES_EDE_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_DSS_ARCFOUR_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_PSK_SHA_AES_256_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_PSK_SHA_AES_128_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_PSK_SHA_3DES_EDE_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_PSK_SHA_ARCFOUR_SHA1
|<3>| HSK[0x801236000]: Removing ciphersuite: SRP_SHA_RSA_AES_256_CBC_SHA1
|<3>| HSK[0x801236000]: Removing ciphersuite: SRP_SHA_RSA_AES_128_CBC_SHA1
|<3>| HSK[0x801236000]: Removing ciphersuite: SRP_SHA_RSA_3DES_EDE_CBC_SHA1
|<3>| HSK[0x801236000]: Removing ciphersuite: SRP_SHA_DSS_AES_256_CBC_SHA1
|<3>| HSK[0x801236000]: Removing ciphersuite: SRP_SHA_DSS_AES_128_CBC_SHA1
|<3>| HSK[0x801236000]: Removing ciphersuite: SRP_SHA_DSS_3DES_EDE_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: RSA_AES_256_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: RSA_AES_128_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: RSA_3DES_EDE_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: RSA_ARCFOUR_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: RSA_ARCFOUR_MD5
|<3>| HSK[0x801236000]: Keeping ciphersuite: PSK_SHA_AES_256_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: PSK_SHA_AES_128_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: PSK_SHA_3DES_EDE_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: PSK_SHA_ARCFOUR_SHA1
|<3>| HSK[0x801236000]: Removing ciphersuite: SRP_SHA_AES_256_CBC_SHA1
|<3>| HSK[0x801236000]: Removing ciphersuite: SRP_SHA_AES_128_CBC_SHA1
|<3>| HSK[0x801236000]: Removing ciphersuite: SRP_SHA_3DES_EDE_CBC_SHA1
[SNIP]
- Version: TLS1.1
- Key Exchange: DHE-RSA
- Cipher: AES-256-CBC
- MAC: SHA1
- Compression: NULL
- Handshake was completed

bazerka <bazerka>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by flashcode (Posted a comment)
  • -email is unavailable- added by bazerka (Submitted the item)
  • -email is unavailable- added by bazerka
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2011-05-15 flashcode Open/ClosedOpen => Closed
    2011-04-28 flashcode Categoryother => irc plugin
        StatusNone => Done
        Percent Complete0% => 100%
        Assigned toNone => flashcode
        Planned ReleaseNone => 0.3.5
    2010-01-18 bazerka Carbon-Copy- => Added bazerka

    Back to the top


    Powered by Savane 3.4