Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 1057717 - s_client utility doesn't report the size of used DHE and ECDHE parameters selected by server
Summary: s_client utility doesn't report the size of used DHE and ECDHE parameters sel...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: openssl
Version: 7.0
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: rc
: ---
Assignee: Tomas Mraz
QA Contact: Hubert Kario
URL:
Whiteboard:
Depends On: 1057715
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-01-24 16:32 UTC by Hubert Kario
Modified: 2014-09-02 11:18 UTC (History)
2 users (show)

Fixed In Version: openssl-1.0.1e-31.el7
Doc Type: Bug Fix
Doc Text:
When connecting to a server using ECDHE-based or DHE-based cipher suites, the s_client utility now reports the size of ECDHE and DHE parameters selected by the server. This allows for easy verification whether the used configuration set is secure.
Clone Of: 1057715
Environment:
Last Closed: 2014-06-13 10:30:31 UTC


Attachments (Terms of Use)

Description Hubert Kario 2014-01-24 16:32:08 UTC
Description of problem:
When connecting to server using one of the ECDHE-* and DHE-* suites, openssl s_client utility doesn't report the size of parameters selected by server.

This makes it hard to verify if the configuration set is secure.

Version-Release number of selected component (if applicable):
openssl-1.0.1e-29.el7.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Run openssl s_server
2. Connect openssl s_client to it

Alternatively:
1. openssl s_client -connect www.google.com:443

Actual results:
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-GCM-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES128-GCM-SHA256
    Session-ID: 8E883DD2A0476D7898F5A4485E1647760609D880D187EA9DD3481B93080CB629
    Session-ID-ctx: 
    Master-Key: C78ED7F083A6CB066729DCE229F754F6D5D38DA7B9326364E2F9F11F00C1557E2AD1D2543BF77A37E503A2E29AD5FEE9
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    TLS session ticket lifetime hint: 100800 (seconds)
    TLS session ticket:
    0000 - 0a 12 64 19 5b 28 de 75-0b 4c 00 80 c9 ef 0b 60   ..d.[(.u.L.....`
    0010 - 84 65 2f a4 db 28 8d 13-db ae 39 8b 2a d6 8c 71   .e/..(....9.*..q
    0020 - 08 84 84 58 2f e6 f5 3f-24 07 00 52 5b d2 46 54   ...X/..?$..R[.FT
    0030 - ba ac d6 0b d7 ae 1a 75-c8 ad 23 0f d2 d5 4b fa   .......u..#...K.
    0040 - cd 50 07 3f 9d 1c 57 b6-ea 8e c7 06 0c ed 9c 4b   .P.?..W........K
    0050 - 4a 68 2f 0a 6a b6 6e 13-92 c5 c8 07 aa 77 17 97   Jh/.j.n......w..
    0060 - 53 e8 8b 67 4a bb f3 a1-fb b8 9b 30 7f 79 c1 4f   S..gJ......0.y.O
    0070 - 47 c9 52 a2 5c 4d 93 33-dc 69 6c 5d 5c df 7c 2d   G.R.\M.3.il]\.|-
    0080 - 5a 55 0a 86 14 8a 20 82-0f b7 90 ae 6b 60 e4 a0   ZU.... .....k`..
    0090 - b2 0a ad 2b                                       ...+

    Start Time: 1390580593
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)

Expected results:
ECDHE parameters size or DHE parameters size in case of DHE suite listed together with all other information about SSL-Session.

Additional info:
Needed for verification of bug 1057656, bug 1057687, bug 1035818 and others with all suites supported by mod_ssl.

Comment 2 Tomas Mraz 2014-01-24 16:48:28 UTC
I'm sorry but this is by no means a blocker. It should be at least submitted to upstream first for review.

The DH parameter size and ECDHE curve is determined by the server.

Comment 6 Ludek Smid 2014-06-13 10:30:31 UTC
This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.


Note You need to log in before you can comment on or make changes to this bug.