Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 1057715 - s_client utility doesn't report the size of used DHE and ECDHE parameters selected by server
Summary: s_client utility doesn't report the size of used DHE and ECDHE parameters sel...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: openssl
Version: 6.5
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: rc
: ---
Assignee: Tomas Mraz
QA Contact: Hubert Kario
URL:
Whiteboard:
Depends On:
Blocks: 1057717
TreeView+ depends on / blocked
 
Reported: 2014-01-24 16:27 UTC by Hubert Kario
Modified: 2014-10-14 07:19 UTC (History)
2 users (show)

Fixed In Version: openssl-1.0.1e-26.el6
Doc Type: Enhancement
Doc Text:
When connecting to a server using ECDHE-based or DHE-based cipher suites, the s_client utility now reports the size of ECDHE and DHE parameters selected by the server. This allows for easy verification whether the used configuration set is secure.
Clone Of:
: 1057717 (view as bug list)
Environment:
Last Closed: 2014-10-14 07:19:38 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2014:1525 normal SHIPPED_LIVE openssl bug fix and enhancement update 2014-10-14 01:22:05 UTC

Description Hubert Kario 2014-01-24 16:27:00 UTC
Description of problem:
When connecting to server using one of the ECDHE-* and DHE-* suites, openssl s_client utility doesn't report the size of parameters selected by server.

This makes it hard to verify if the configuration set is secure.

Version-Release number of selected component (if applicable):
openssl-1.0.1e-15.el6.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Run openssl s_server
2. Connect openssl s_client to it

Alternatively:
1. openssl s_client -connect www.google.com:443

Actual results:
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-GCM-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES128-GCM-SHA256
    Session-ID: 8E883DD2A0476D7898F5A4485E1647760609D880D187EA9DD3481B93080CB629
    Session-ID-ctx: 
    Master-Key: C78ED7F083A6CB066729DCE229F754F6D5D38DA7B9326364E2F9F11F00C1557E2AD1D2543BF77A37E503A2E29AD5FEE9
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    TLS session ticket lifetime hint: 100800 (seconds)
    TLS session ticket:
    0000 - 0a 12 64 19 5b 28 de 75-0b 4c 00 80 c9 ef 0b 60   ..d.[(.u.L.....`
    0010 - 84 65 2f a4 db 28 8d 13-db ae 39 8b 2a d6 8c 71   .e/..(....9.*..q
    0020 - 08 84 84 58 2f e6 f5 3f-24 07 00 52 5b d2 46 54   ...X/..?$..R[.FT
    0030 - ba ac d6 0b d7 ae 1a 75-c8 ad 23 0f d2 d5 4b fa   .......u..#...K.
    0040 - cd 50 07 3f 9d 1c 57 b6-ea 8e c7 06 0c ed 9c 4b   .P.?..W........K
    0050 - 4a 68 2f 0a 6a b6 6e 13-92 c5 c8 07 aa 77 17 97   Jh/.j.n......w..
    0060 - 53 e8 8b 67 4a bb f3 a1-fb b8 9b 30 7f 79 c1 4f   S..gJ......0.y.O
    0070 - 47 c9 52 a2 5c 4d 93 33-dc 69 6c 5d 5c df 7c 2d   G.R.\M.3.il]\.|-
    0080 - 5a 55 0a 86 14 8a 20 82-0f b7 90 ae 6b 60 e4 a0   ZU.... .....k`..
    0090 - b2 0a ad 2b                                       ...+

    Start Time: 1390580593
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)

Expected results:
ECDHE parameters size
DHE parameters size in case of DHE suite

Additional info:
Needed for verification of bug 1057656, bug 1057687 and bug 1035818 with all suites supported by mod_ssl.

Comment 2 Tomas Mraz 2014-01-24 16:49:10 UTC
I'm sorry but this is by no means a blocker. It should be at least submitted to upstream first for review.

The DH parameter size and ECDHE curve is determined by the server.

Comment 4 Hubert Kario 2014-01-27 15:26:56 UTC
Needed changes are available upstream:
http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=33a8de69dc092285fce9a3db4aae2b0df8852427

Comment 7 errata-xmlrpc 2014-10-14 07:19:38 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2014-1525.html


Note You need to log in before you can comment on or make changes to this bug.