taskWeeChat - Tasks: task #10106, Allow configurable TLS priorities...

 
 

task #10106: Allow configurable TLS priorities or hardcode the use of SECURE256 priority

Submitter:  bazerka <bazerka>
Submitted:  Mon 18 Jan 2010 10:38:46 PM UTC
   
 
Category:  irc plugin Should Start On:  Mon 18 Jan 2010 12:00:00 AM UTC
Should be Finished on:  Mon 18 Jan 2010 12:00:00 AM UTC Priority:  * 5 - Normal
Status:  Done Privacy:  Public
Assigned to:  flashcode Percent Complete:  100%
Originator Name:  Open/Closed:  Closed
Planned Release:  0.3.5 IRC nick:  Bazerka
* Mandatory Fields

Add a New Comment Rich Markup
   

Thu 28 Apr 2011 10:59:26 AM UTC, comment #1: 

Done with option "ssl_priorities" in IRC servers.

 Sebastien Helleu <flashcode>
Group administrator
Mon 18 Jan 2010 10:38:46 PM UTC, original submission:  

At present, TLS priorities are hardcoded to specify a preference list of protocols only.

Due to this, 128bit ciphersuites are appearing in the ciphersuite list prior to their 256bit counterparts and hence, will always be used in preference.

I suggest either allowing the priority string to be user configurable, or hardcoding the priority to include SECURE256 as well as the protocol, so that the available cipersuite list is sorted from strongest to weakest (ie, 256bit ciphersuites are listed before the 128bit variants).

For example,

gnutls-cli connecting to an ssl ircd without --priority SECURE256 shows :

|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_RSA_AES_128_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_RSA_AES_256_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_RSA_3DES_EDE_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_DSS_AES_128_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_DSS_AES_256_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_DSS_3DES_EDE_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_DSS_ARCFOUR_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_PSK_SHA_AES_128_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_PSK_SHA_AES_256_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_PSK_SHA_3DES_EDE_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_PSK_SHA_ARCFOUR_SHA1
|<3>| HSK[0x801236000]: Removing ciphersuite: SRP_SHA_RSA_AES_128_CBC_SHA1
|<3>| HSK[0x801236000]: Removing ciphersuite: SRP_SHA_RSA_AES_256_CBC_SHA1
|<3>| HSK[0x801236000]: Removing ciphersuite: SRP_SHA_RSA_3DES_EDE_CBC_SHA1
|<3>| HSK[0x801236000]: Removing ciphersuite: SRP_SHA_DSS_AES_128_CBC_SHA1
|<3>| HSK[0x801236000]: Removing ciphersuite: SRP_SHA_DSS_AES_256_CBC_SHA1
|<3>| HSK[0x801236000]: Removing ciphersuite: SRP_SHA_DSS_3DES_EDE_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: RSA_AES_128_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: RSA_AES_256_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: RSA_3DES_EDE_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: RSA_ARCFOUR_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: RSA_ARCFOUR_MD5
|<3>| HSK[0x801236000]: Keeping ciphersuite: PSK_SHA_AES_128_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: PSK_SHA_AES_256_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: PSK_SHA_3DES_EDE_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: PSK_SHA_ARCFOUR_SHA1
|<3>| HSK[0x801236000]: Removing ciphersuite: SRP_SHA_AES_128_CBC_SHA1
|<3>| HSK[0x801236000]: Removing ciphersuite: SRP_SHA_AES_256_CBC_SHA1
|<3>| HSK[0x801236000]: Removing ciphersuite: SRP_SHA_3DES_EDE_CBC_SHA1
[SNIP]
- Version: TLS1.1
- Key Exchange: DHE-RSA
- Cipher: AES-128-CBC
- MAC: SHA1
- Compression: NULL
- Handshake was completed


Connecting to the same ircd with --priority SECURE256 shows:

|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_RSA_AES_256_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_RSA_AES_128_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_RSA_3DES_EDE_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_DSS_AES_256_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_DSS_AES_128_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_DSS_3DES_EDE_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_DSS_ARCFOUR_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_PSK_SHA_AES_256_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_PSK_SHA_AES_128_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_PSK_SHA_3DES_EDE_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: DHE_PSK_SHA_ARCFOUR_SHA1
|<3>| HSK[0x801236000]: Removing ciphersuite: SRP_SHA_RSA_AES_256_CBC_SHA1
|<3>| HSK[0x801236000]: Removing ciphersuite: SRP_SHA_RSA_AES_128_CBC_SHA1
|<3>| HSK[0x801236000]: Removing ciphersuite: SRP_SHA_RSA_3DES_EDE_CBC_SHA1
|<3>| HSK[0x801236000]: Removing ciphersuite: SRP_SHA_DSS_AES_256_CBC_SHA1
|<3>| HSK[0x801236000]: Removing ciphersuite: SRP_SHA_DSS_AES_128_CBC_SHA1
|<3>| HSK[0x801236000]: Removing ciphersuite: SRP_SHA_DSS_3DES_EDE_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: RSA_AES_256_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: RSA_AES_128_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: RSA_3DES_EDE_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: RSA_ARCFOUR_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: RSA_ARCFOUR_MD5
|<3>| HSK[0x801236000]: Keeping ciphersuite: PSK_SHA_AES_256_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: PSK_SHA_AES_128_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: PSK_SHA_3DES_EDE_CBC_SHA1
|<3>| HSK[0x801236000]: Keeping ciphersuite: PSK_SHA_ARCFOUR_SHA1
|<3>| HSK[0x801236000]: Removing ciphersuite: SRP_SHA_AES_256_CBC_SHA1
|<3>| HSK[0x801236000]: Removing ciphersuite: SRP_SHA_AES_128_CBC_SHA1
|<3>| HSK[0x801236000]: Removing ciphersuite: SRP_SHA_3DES_EDE_CBC_SHA1
[SNIP]
- Version: TLS1.1
- Key Exchange: DHE-RSA
- Cipher: AES-256-CBC
- MAC: SHA1
- Compression: NULL
- Handshake was completed

bazerka <bazerka>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by flashcode (Posted a comment)
  • -email is unavailable- added by bazerka (Submitted the item)
  • -email is unavailable- added by bazerka

    •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2011-05-15 flashcode Open/ClosedOpen Closed
    2011-04-28 flashcode Categoryother irc plugin
        StatusNone Done
        Percent Complete0% 100%
        Assigned toNone flashcode
        Planned ReleaseNone 0.3.5
    2010-01-18 bazerka Carbon-Copy- Added bazerka

    Back to the top

    Copyright © 2024 Free Software Foundation, Inc.
    Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
    The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
    Page source code

    Powered by Savane 3.14-f13d.
    Corresponding source code