Bug 1078084 – IO::Socket::SSL does not support ECDHE

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1078084 - IO::Socket::SSL does not support ECDHE

Summary:	IO::Socket::SSL does not support ECDHE

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat Enterprise Linux 6
Classification:	Red Hat
Component:	perl-IO-Socket-SSL (Show other bugs)
Sub Component:
Version:	6.5
Hardware:	x86_64 Linux

Priority	unspecified Severity medium
Target Milestone:	rc
Target Release:	---
Assigned To:	perl-maint-list
QA Contact:	Stanislav Zidek
Docs Contact:	Lenka Špačková

URL:
Whiteboard:
Keywords:	FutureFeature, Patch

Depends On:	1044401 1078301
Blocks:	1002711 1057564 1254457 1269913
	Show dependency tree / graph

Reported:	2014-03-19 03:02 EDT by Petr Pisar
Modified:	2016-05-11 03:01 EDT (History)
CC List:	12 users (show)

See Also:
Fixed In Version:	perl-IO-Socket-SSL-1.31-3.el6
Doc Type:	Enhancement
Doc Text:	Perl IO::Socket::SSL now supports ECDHE Support for Elliptic Curve Diffie–Hellman Exchange (ECDHE) has been added to the IO::Socket::SSL Perl module. The new `SSL_ecdh_curve` option can be used for specifying a suitable curve by the Object Identifier (OID) or Name Identifier (NID). As a result, it is now possible to override the default elliptic curve parameters when implementing a TLS client using IO::Socket:SSL.
Story Points:	---
Clone Of:	1044401
Clones:	1316377 (view as bug list)
Environment:
Last Closed:	2016-05-10 16:06:32 EDT
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Upstream support for ECDH key exchange ported to 1.31 (4.93 KB, patch) 2014-03-19 09:59 EDT, Petr Pisar	no flags	Details \| Diff
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHBA-2016:0768	normal	SHIPPED_LIVE	perl-IO-Socket-SSL bug fix and enhancement update	2016-05-10 18:34:18 EDT

Groups: None (edit)

Description Petr Pisar 2014-03-19 03:02:54 EDT

[...]
--- Additional comment from Deepak Das on 2014-02-27 08:45:44 GMT ---

The issue is not from openssl end. The issue seems to be on perl side. 

During ssl handshake "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA" cipher was selected. It seems perl shipped with RHEL 6.5 does not have support to handle ECDHE based connection.

When following cpan modules were installed in perl the issue got resolved.

  1) cpan  Net::SSLeay

  2) cpan  IO::Socket::SSL

--- Additional comment from Tomas Mraz on 2014-02-27 09:49:01 GMT ---

This is fairly strange as the TLS client side should not require any code changes for ECDHE support. Perhaps just rebuild of these perl packages would help?
Reassigning.

--- Additional comment from Petr Pisar on 2014-02-27 10:22:43 GMT ---

Rebuild is not enough. One has to add the support to the binding and upper layers.

Support for ECDH has been added by upstream in IO-Socket-SSL-1.955 and Net-SSLeay-1.56.

RHEL-6 delivers perl-IO-Socket-SSL-1.31-2.el6 and perl-Net-SSLeay-1.35-9.el6.

[...]
--- Additional comment from Petr Pisar on 2014-03-19 06:54:38 GMT ---

There is definitely the problem that Perl TLS libraries as delivered by Red Hat Enterprise Linux 6 now do not support ECDHE. We will focus on this issue first.

We need to port the support available from latest version as described in comment #19.
----

IO::Socket:SSL as layer above Net::SSLeay has to be fixed too.

The reproducer is t/ecdhe.t from recent IO-Socket-SSL test suite <http://cpansearch.perl.org/src/SULLR/IO-Socket-SSL-1.969/t/ecdhe.t>.

Comment 1 Petr Pisar 2014-03-19 09:59:58 EDT

Created attachment 876353 [details]
Upstream support for ECDH key exchange ported to 1.31

Comment 7 Petr Pisar 2015-11-13 10:44:25 EST

How to test:

(1) Use t/ecdhe.t from recent IO-Socket-SSL test suite <http://cpansearch.perl.org/src/SULLR/IO-Socket-SSL-1.969/t/ecdhe.t>. You will need some other files (pregenerated keys) from there probably.

Comment 11 errata-xmlrpc 2016-05-10 16:06:32 EDT

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-0768.html

Note You need to log in before you can comment on or make changes to this bug.