Bug 1073081

Summary: mod_ssl selects correct DHE parameters for keys only up to 4096 bit
Product: Red Hat Enterprise Linux 7 Reporter: Alicja Kario <hkario>
Component: httpdAssignee: Luboš Uhliarik <luhliari>
Status: CLOSED ERRATA QA Contact: Martin Frodl <mfrodl>
Severity: low Docs Contact:
Priority: low    
Version: 7.0CC: jkaluza, jorton, mfrodl, rmainz
Target Milestone: rcKeywords: Regression
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: httpd-2.4.6-20.el7 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-03-05 07:12:29 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1057687, 1071292, 1073078, 1180223    
Bug Blocks:    

Description Alicja Kario 2014-03-05 17:47:40 UTC 
Description of problem:
When using keys that provide 192 bit security (7680 bit RSA[1]), mod_ssl selects only 4096 bit long DHE parameters.

Version-Release number of selected component (if applicable):
httpd-2.4.6-16.el7

How reproducible:
Always

Steps to Reproduce:
SSLCRT=/etc/pki/tls/certs/localhost.crt
SSLKEY=/etc/pki/tls/private/localhost.key

openssl req -x509 -newkey rsa:7680 -keyout ${SSLKEY} -out ${SSLCRT} -subj /CN=localhost -nodes -batch

systemctl restart httpd

openssl s_client -CAfile ${SSLCRT} -cipher 'kEDH:!aNULL' -connect localhost:443

Actual results:
---
No client certificate CA names sent
Server Temp Key: DH, 4096 bits
---
SSL handshake has read 4532 bytes and written 806 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-GCM-SHA384
Server public key is 8192 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : DHE-RSA-AES256-GCM-SHA384
    Session-ID: DB8B7F0A108852065FBADD51EDBEE30AE24A669B6A8C3495E8B5733040C02EDD
    Session-ID-ctx: 
    Master-Key: 451DFE6AB51F8B1E13E7BB09D723DFC84EE29A0D2699E61D35EDFED5A945CB27BE345466A02395EE3AC310EDB748E5C0
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    Start Time: 1394040945
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)

Expected results:
---
No client certificate CA names sent
Server Temp Key: DH, 8192 bits
---

Additional info:
While generation of DHE parameters of this size take significant amount of time, openssl 1.0.1 has well known dhe parameters up to 8192 bit so there is little reason not to use them.
This is also why this entry doesn't apply for 256 bit security level.

 1 - http://csrc.nist.gov/publications/nistpubs/800-57/sp800-57_part1_rev3_general.pdf
Comment 10 errata-xmlrpc 2015-03-05 07:12:29 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2015-0325.html