You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
159 lines
7.3 KiB
159 lines
7.3 KiB
7 years ago
|
diff -up openssl-1.0.1e/doc/ssl/SSL_CTX_set_options.pod.rsa-ephemeral openssl-1.0.1e/doc/ssl/SSL_CTX_set_options.pod
|
||
|
|
--- openssl-1.0.1e/doc/ssl/SSL_CTX_set_options.pod.rsa-ephemeral 2013-02-11 16:26:04.000000000 +0100
|
||
|
|
+++ openssl-1.0.1e/doc/ssl/SSL_CTX_set_options.pod 2015-01-13 11:15:25.096957795 +0100
|
||
|
|
@@ -151,15 +151,7 @@ temporary/ephemeral DH parameters are us
|
||
|
|
|
||
|
|
=item SSL_OP_EPHEMERAL_RSA
|
||
|
|
|
||
|
|
-Always use ephemeral (temporary) RSA key when doing RSA operations
|
||
|
|
-(see L<SSL_CTX_set_tmp_rsa_callback(3)|SSL_CTX_set_tmp_rsa_callback(3)>).
|
||
|
|
-According to the specifications this is only done, when a RSA key
|
||
|
|
-can only be used for signature operations (namely under export ciphers
|
||
|
|
-with restricted RSA keylength). By setting this option, ephemeral
|
||
|
|
-RSA keys are always used. This option breaks compatibility with the
|
||
|
|
-SSL/TLS specifications and may lead to interoperability problems with
|
||
|
|
-clients and should therefore never be used. Ciphers with EDH (ephemeral
|
||
|
|
-Diffie-Hellman) key exchange should be used instead.
|
||
|
|
+This option is no longer implemented and is treated as no op.
|
||
|
|
|
||
|
|
=item SSL_OP_CIPHER_SERVER_PREFERENCE
|
||
|
|
|
||
|
|
diff -up openssl-1.0.1e/doc/ssl/SSL_CTX_set_tmp_rsa_callback.pod.rsa-ephemeral openssl-1.0.1e/doc/ssl/SSL_CTX_set_tmp_rsa_callback.pod
|
||
|
|
--- openssl-1.0.1e/doc/ssl/SSL_CTX_set_tmp_rsa_callback.pod.rsa-ephemeral 2013-02-11 16:02:48.000000000 +0100
|
||
|
|
+++ openssl-1.0.1e/doc/ssl/SSL_CTX_set_tmp_rsa_callback.pod 2015-01-13 11:15:25.096957795 +0100
|
||
|
|
@@ -74,21 +74,14 @@ exchange and use EDH (Ephemeral Diffie-H
|
||
|
|
in order to achieve forward secrecy (see
|
||
|
|
L<SSL_CTX_set_tmp_dh_callback(3)|SSL_CTX_set_tmp_dh_callback(3)>).
|
||
|
|
|
||
|
|
-On OpenSSL servers ephemeral RSA key exchange is therefore disabled by default
|
||
|
|
-and must be explicitly enabled using the SSL_OP_EPHEMERAL_RSA option of
|
||
|
|
-L<SSL_CTX_set_options(3)|SSL_CTX_set_options(3)>, violating the TLS/SSL
|
||
|
|
-standard. When ephemeral RSA key exchange is required for export ciphers,
|
||
|
|
-it will automatically be used without this option!
|
||
|
|
-
|
||
|
|
-An application may either directly specify the key or can supply the key via
|
||
|
|
-a callback function. The callback approach has the advantage, that the
|
||
|
|
-callback may generate the key only in case it is actually needed. As the
|
||
|
|
-generation of a RSA key is however costly, it will lead to a significant
|
||
|
|
-delay in the handshake procedure. Another advantage of the callback function
|
||
|
|
-is that it can supply keys of different size (e.g. for SSL_OP_EPHEMERAL_RSA
|
||
|
|
-usage) while the explicit setting of the key is only useful for key size of
|
||
|
|
-512 bits to satisfy the export restricted ciphers and does give away key length
|
||
|
|
-if a longer key would be allowed.
|
||
|
|
+An application may either directly specify the key or can supply the key via a
|
||
|
|
+callback function. The callback approach has the advantage, that the callback
|
||
|
|
+may generate the key only in case it is actually needed. As the generation of a
|
||
|
|
+RSA key is however costly, it will lead to a significant delay in the handshake
|
||
|
|
+procedure. Another advantage of the callback function is that it can supply
|
||
|
|
+keys of different size while the explicit setting of the key is only useful for
|
||
|
|
+key size of 512 bits to satisfy the export restricted ciphers and does give
|
||
|
|
+away key length if a longer key would be allowed.
|
||
|
|
|
||
|
|
The B<tmp_rsa_callback> is called with the B<keylength> needed and
|
||
|
|
the B<is_export> information. The B<is_export> flag is set, when the
|
||
|
|
diff -up openssl-1.0.1e/CHANGES.rsa-ephemeral openssl-1.0.1e/CHANGES
|
||
|
|
diff -up openssl-1.0.1e/ssl/d1_srvr.c.rsa-ephemeral openssl-1.0.1e/ssl/d1_srvr.c
|
||
|
|
--- openssl-1.0.1e/ssl/d1_srvr.c.rsa-ephemeral 2015-01-12 17:49:04.912808002 +0100
|
||
|
|
+++ openssl-1.0.1e/ssl/d1_srvr.c 2015-01-13 11:15:25.096957795 +0100
|
||
|
|
@@ -450,24 +450,15 @@ int dtls1_accept(SSL *s)
|
||
|
|
case SSL3_ST_SW_KEY_EXCH_B:
|
||
|
|
alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
|
||
|
|
|
||
|
|
- /* clear this, it may get reset by
|
||
|
|
- * send_server_key_exchange */
|
||
|
|
- if ((s->options & SSL_OP_EPHEMERAL_RSA)
|
||
|
|
-#ifndef OPENSSL_NO_KRB5
|
||
|
|
- && !(alg_k & SSL_kKRB5)
|
||
|
|
-#endif /* OPENSSL_NO_KRB5 */
|
||
|
|
- )
|
||
|
|
- /* option SSL_OP_EPHEMERAL_RSA sends temporary RSA key
|
||
|
|
- * even when forbidden by protocol specs
|
||
|
|
- * (handshake may fail as clients are not required to
|
||
|
|
- * be able to handle this) */
|
||
|
|
- s->s3->tmp.use_rsa_tmp=1;
|
||
|
|
- else
|
||
|
|
- s->s3->tmp.use_rsa_tmp=0;
|
||
|
|
+ /*
|
||
|
|
+ * clear this, it may get reset by
|
||
|
|
+ * send_server_key_exchange
|
||
|
|
+ */
|
||
|
|
+ s->s3->tmp.use_rsa_tmp=0;
|
||
|
|
|
||
|
|
/* only send if a DH key exchange or
|
||
|
|
* RSA but we have a sign only certificate */
|
||
|
|
- if (s->s3->tmp.use_rsa_tmp
|
||
|
|
+ if (0
|
||
|
|
/* PSK: send ServerKeyExchange if PSK identity
|
||
|
|
* hint if provided */
|
||
|
|
#ifndef OPENSSL_NO_PSK
|
||
|
|
diff -up openssl-1.0.1e/ssl/ssl.h.rsa-ephemeral openssl-1.0.1e/ssl/ssl.h
|
||
|
|
--- openssl-1.0.1e/ssl/ssl.h.rsa-ephemeral 2015-01-12 17:49:04.936808545 +0100
|
||
|
|
+++ openssl-1.0.1e/ssl/ssl.h 2015-01-13 11:15:25.098957840 +0100
|
||
|
|
@@ -587,9 +587,8 @@ struct ssl_session_st
|
||
|
|
#define SSL_OP_SINGLE_ECDH_USE 0x00080000L
|
||
|
|
/* If set, always create a new key when using tmp_dh parameters */
|
||
|
|
#define SSL_OP_SINGLE_DH_USE 0x00100000L
|
||
|
|
-/* Set to always use the tmp_rsa key when doing RSA operations,
|
||
|
|
- * even when this violates protocol specs */
|
||
|
|
-#define SSL_OP_EPHEMERAL_RSA 0x00200000L
|
||
|
|
+/* Does nothing: retained for compatibiity */
|
||
|
|
+#define SSL_OP_EPHEMERAL_RSA 0x0
|
||
|
|
/* Set on servers to choose the cipher according to the server's
|
||
|
|
* preferences */
|
||
|
|
#define SSL_OP_CIPHER_SERVER_PREFERENCE 0x00400000L
|
||
|
|
diff -up openssl-1.0.1e/ssl/s3_clnt.c.rsa-ephemeral openssl-1.0.1e/ssl/s3_clnt.c
|
||
|
|
--- openssl-1.0.1e/ssl/s3_clnt.c.rsa-ephemeral 2015-01-12 17:49:04.946808771 +0100
|
||
|
|
+++ openssl-1.0.1e/ssl/s3_clnt.c 2015-01-13 11:15:25.097957817 +0100
|
||
|
|
@@ -1492,6 +1492,13 @@ int ssl3_get_key_exchange(SSL *s)
|
||
|
|
#ifndef OPENSSL_NO_RSA
|
||
|
|
if (alg_k & SSL_kRSA)
|
||
|
|
{
|
||
|
|
+ /* Temporary RSA keys only allowed in export ciphersuites */
|
||
|
|
+ if (!SSL_C_IS_EXPORT(s->s3->tmp.new_cipher))
|
||
|
|
+ {
|
||
|
|
+ al=SSL_AD_UNEXPECTED_MESSAGE;
|
||
|
|
+ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_UNEXPECTED_MESSAGE);
|
||
|
|
+ goto f_err;
|
||
|
|
+ }
|
||
|
|
if ((rsa=RSA_new()) == NULL)
|
||
|
|
{
|
||
|
|
SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,ERR_R_MALLOC_FAILURE);
|
||
|
|
diff -up openssl-1.0.1e/ssl/s3_srvr.c.rsa-ephemeral openssl-1.0.1e/ssl/s3_srvr.c
|
||
|
|
--- openssl-1.0.1e/ssl/s3_srvr.c.rsa-ephemeral 2015-01-12 17:51:32.044135496 +0100
|
||
|
|
+++ openssl-1.0.1e/ssl/s3_srvr.c 2015-01-13 11:15:25.098957840 +0100
|
||
|
|
@@ -441,20 +441,11 @@ int ssl3_accept(SSL *s)
|
||
|
|
case SSL3_ST_SW_KEY_EXCH_B:
|
||
|
|
alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
|
||
|
|
|
||
|
|
- /* clear this, it may get reset by
|
||
|
|
- * send_server_key_exchange */
|
||
|
|
- if ((s->options & SSL_OP_EPHEMERAL_RSA)
|
||
|
|
-#ifndef OPENSSL_NO_KRB5
|
||
|
|
- && !(alg_k & SSL_kKRB5)
|
||
|
|
-#endif /* OPENSSL_NO_KRB5 */
|
||
|
|
- )
|
||
|
|
- /* option SSL_OP_EPHEMERAL_RSA sends temporary RSA key
|
||
|
|
- * even when forbidden by protocol specs
|
||
|
|
- * (handshake may fail as clients are not required to
|
||
|
|
- * be able to handle this) */
|
||
|
|
- s->s3->tmp.use_rsa_tmp=1;
|
||
|
|
- else
|
||
|
|
- s->s3->tmp.use_rsa_tmp=0;
|
||
|
|
+ /*
|
||
|
|
+ * clear this, it may get reset by
|
||
|
|
+ * send_server_key_exchange
|
||
|
|
+ */
|
||
|
|
+ s->s3->tmp.use_rsa_tmp=0;
|
||
|
|
|
||
|
|
|
||
|
|
/* only send if a DH key exchange, fortezza or
|
||
|
|
@@ -468,7 +459,7 @@ int ssl3_accept(SSL *s)
|
||
|
|
* server certificate contains the server's
|
||
|
|
* public key for key exchange.
|
||
|
|
*/
|
||
|
|
- if (s->s3->tmp.use_rsa_tmp
|
||
|
|
+ if (0
|
||
|
|
/* PSK: send ServerKeyExchange if PSK identity
|
||
|
|
* hint if provided */
|
||
|
|
#ifndef OPENSSL_NO_PSK
|