ssl: conditionally set explicit cipher suite list #66
+47
−52
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Don't set in SSLContext#set_params when built with OpenSSL 1.1.0 or newer. The list was added as a workaround to exclude known weak cipher suites ([Bug #9424]). In OpenSSL <= 1.0.2, the default list (DEFAULT) included even cipher suites using MD5. Now, OpenSSL 1.1.0 has better DEFAULT. So make SSLContext#set_params just use it. Here is the diff between our current explicit list and DEFAULT of OpenSSL 1.1.0-pre6 (with sorted): $ list_ruby=$(openssl ciphers -v $(ruby -ropenssl -e'puts OpenSSL::SSL::SSLContext::DEFAULT_PARAMS[:ciphers]') | sort) $ list_default=$(openssl ciphers -v 'DEAFULT:!PSK:!SRP' | sort) $ diff <(echo "$list_ruby") <(echo "$list_default") 7,12c7 < DHE-DSS-AES128-GCM-SHA256 TLSv1.2 Kx=DH Au=DSS Enc=AESGCM(128) Mac=AEAD < DHE-DSS-AES128-SHA256 TLSv1.2 Kx=DH Au=DSS Enc=AES(128) Mac=SHA256 < DHE-DSS-AES128-SHA SSLv3 Kx=DH Au=DSS Enc=AES(128) Mac=SHA1 < DHE-DSS-AES256-GCM-SHA384 TLSv1.2 Kx=DH Au=DSS Enc=AESGCM(256) Mac=AEAD < DHE-DSS-AES256-SHA256 TLSv1.2 Kx=DH Au=DSS Enc=AES(256) Mac=SHA256 < DHE-DSS-AES256-SHA SSLv3 Kx=DH Au=DSS Enc=AES(256) Mac=SHA1 --- > DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1 18a14,15 > DHE-RSA-CHACHA20-POLY1305 TLSv1.2 Kx=DH Au=RSA Enc=CHACHA20/POLY1305(256) Mac=AEAD > DHE-RSA-DES-CBC3-SHA SSLv3 Kx=DH Au=RSA Enc=3DES(168) Mac=SHA1 24a22,23 > ECDHE-ECDSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH Au=ECDSA Enc=CHACHA20/POLY1305(256) Mac=AEAD > ECDHE-ECDSA-DES-CBC3-SHA SSLv3 Kx=ECDH Au=ECDSA Enc=3DES(168) Mac=SHA1 30a30,31 > ECDHE-RSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH Au=RSA Enc=CHACHA20/POLY1305(256) Mac=AEAD > ECDHE-RSA-DES-CBC3-SHA SSLv3 Kx=ECDH Au=RSA Enc=3DES(168) Mac=SHA1
|
Hmm, as it were, there are things I don't like in either list: Ruby
OpenSSL
Either way, it would be nice to see ChaCha20+Poly1305 included by default. So I guess that's a weak 👍 from me. |
|
Thanks. I guess OpenSSL left 3DES because it is the MTI cipher suite in TLS 1.0/1.1, or for Windows XP compatibility. Yes, actually my main point of this patch is ChaCha20-Poly1305. I could just add them to the list, but given that OpenSSL refreshed the defaults, I think it's good timing to get back to it. Ruby/OpenSSL is not in a position to judge what is secure and the explicit list is just a workaround. I really hope future versions of OpenSSL will keep it secure... |
|
For what it's worth: practical birthday attacks on 64-bit block ciphers in TLS, including 3DES: |
|
And OpenSSL has removed 3DES from DEFAULT: openssl/openssl@ef28891 The new full list: |
|
Just in time too! OpenSSL 1.1.0 was just released: https://www.openssl.org/news/openssl-1.1.0-notes.html |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Don't set in SSLContext#set_params when built with OpenSSL 1.1.0 or
newer.
The list was added as a workaround to exclude known weak cipher suites
([Bug #9424]). In OpenSSL <= 1.0.2, the default list (DEFAULT) included
even cipher suites using MD5. Now, OpenSSL 1.1.0 has better DEFAULT. So
make SSLContext#set_params just use it.
Here is the diff between our current explicit list and DEFAULT of
OpenSSL 1.1.0-pre6 (with sorted):