1057717 – s_client utility doesn't report the size of used DHE and ECDHE parameters selected by server

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1057717 - s_client utility doesn't report the size of used DHE and ECDHE parameters selected by server

Summary: s_client utility doesn't report the size of used DHE and ECDHE parameters sel...

Keywords:
Status:	CLOSED CURRENTRELEASE
Alias:	None
Product:	Red Hat Enterprise Linux 7
Classification:	Red Hat
Component:	openssl
Sub Component:
Version:	7.0
Hardware:	Unspecified
OS:	Unspecified
Priority:	medium
Severity:	medium
Target Milestone:	rc
Target Release:	---
Assignee:	Tomas Mraz
QA Contact:	Alicja Kario
Docs Contact:
URL:
Whiteboard:
Depends On:	1057715
Blocks:
TreeView+	depends on / blocked

Reported:	2014-01-24 16:32 UTC by Alicja Kario
Modified:	2014-09-02 11:18 UTC (History)
CC List:	2 users (show)
Fixed In Version:	openssl-1.0.1e-31.el7
Doc Type:	Bug Fix
Doc Text:	When connecting to a server using ECDHE-based or DHE-based cipher suites, the s_client utility now reports the size of ECDHE and DHE parameters selected by the server. This allows for easy verification whether the used configuration set is secure.
Clone Of:	1057715
Environment:
Last Closed:	2014-06-13 10:30:31 UTC
Target Upstream Version:
Embargoed:

Attachments	(Terms of Use)

Description Alicja Kario 2014-01-24 16:32:08 UTC

Description of problem:
When connecting to server using one of the ECDHE-* and DHE-* suites, openssl s_client utility doesn't report the size of parameters selected by server.

This makes it hard to verify if the configuration set is secure.

Version-Release number of selected component (if applicable):
openssl-1.0.1e-29.el7.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Run openssl s_server
2. Connect openssl s_client to it

Alternatively:
1. openssl s_client -connect www.google.com:443

Actual results:
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-GCM-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES128-GCM-SHA256
    Session-ID: 8E883DD2A0476D7898F5A4485E1647760609D880D187EA9DD3481B93080CB629
    Session-ID-ctx: 
    Master-Key: C78ED7F083A6CB066729DCE229F754F6D5D38DA7B9326364E2F9F11F00C1557E2AD1D2543BF77A37E503A2E29AD5FEE9
    Key-Arg   : None
    Krb5 Principal: None
    PSK identity: None
    PSK identity hint: None
    TLS session ticket lifetime hint: 100800 (seconds)
    TLS session ticket:
    0000 - 0a 12 64 19 5b 28 de 75-0b 4c 00 80 c9 ef 0b 60   ..d.[(.u.L.....`
    0010 - 84 65 2f a4 db 28 8d 13-db ae 39 8b 2a d6 8c 71   .e/..(....9.*..q
    0020 - 08 84 84 58 2f e6 f5 3f-24 07 00 52 5b d2 46 54   ...X/..?$..R[.FT
    0030 - ba ac d6 0b d7 ae 1a 75-c8 ad 23 0f d2 d5 4b fa   .......u..#...K.
    0040 - cd 50 07 3f 9d 1c 57 b6-ea 8e c7 06 0c ed 9c 4b   .P.?..W........K
    0050 - 4a 68 2f 0a 6a b6 6e 13-92 c5 c8 07 aa 77 17 97   Jh/.j.n......w..
    0060 - 53 e8 8b 67 4a bb f3 a1-fb b8 9b 30 7f 79 c1 4f   S..gJ......0.y.O
    0070 - 47 c9 52 a2 5c 4d 93 33-dc 69 6c 5d 5c df 7c 2d   G.R.\M.3.il]\.|-
    0080 - 5a 55 0a 86 14 8a 20 82-0f b7 90 ae 6b 60 e4 a0   ZU.... .....k`..
    0090 - b2 0a ad 2b                                       ...+

    Start Time: 1390580593
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)

Expected results:
ECDHE parameters size or DHE parameters size in case of DHE suite listed together with all other information about SSL-Session.

Additional info:
Needed for verification of bug 1057656, bug 1057687, bug 1035818 and others with all suites supported by mod_ssl.

Comment 2 Tomas Mraz 2014-01-24 16:48:28 UTC

I'm sorry but this is by no means a blocker. It should be at least submitted to upstream first for review.

The DH parameter size and ECDHE curve is determined by the server.

Comment 6 Ludek Smid 2014-06-13 10:30:31 UTC

This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.

Note You need to log in before you can comment on or make changes to this bug.