Your message dated Fri, 29 Nov 2019 19:39:52 +0100 with message-id <[email protected]> and subject line Re: Bug#945049: gnutls: Please prefer PFS ciphers over plain RSA ones. has caused the Debian Bug report #945049, regarding gnutls: Please prefer PFS ciphers over plain RSA ones. to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 945049: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=945049 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---Package: gnutls28 Version: 3.6.7-4 Severity: important Assuming the client program did not specify a cipher list we end up with NORMAL and this can be display via gnutls-cli --list --priority NORMAL If we strip TLS1.3 and ECDHE away (because the remote side does not support it) then we end up with: |TLS_RSA_AES_256_GCM_SHA384 0x00, 0x9d TLS1.2 |TLS_RSA_AES_256_CCM 0xc0, 0x9d TLS1.2 |TLS_RSA_AES_256_CBC_SHA1 0x00, 0x35 TLS1.0 |TLS_RSA_AES_128_GCM_SHA256 0x00, 0x9c TLS1.2 |TLS_RSA_AES_128_CCM 0xc0, 0x9c TLS1.2 |TLS_RSA_AES_128_CBC_SHA1 0x00, 0x2f TLS1.0 |TLS_DHE_RSA_AES_256_GCM_SHA384 0x00, 0x9f TLS1.2 |TLS_DHE_RSA_CHACHA20_POLY1305 0xcc, 0xaa TLS1.2 |TLS_DHE_RSA_AES_256_CCM 0xc0, 0x9f TLS1.2 |TLS_DHE_RSA_AES_256_CBC_SHA1 0x00, 0x39 TLS1.0 |TLS_DHE_RSA_AES_128_GCM_SHA256 0x00, 0x9e TLS1.2 |TLS_DHE_RSA_AES_128_CCM 0xc0, 0x9e TLS1.2 |TLS_DHE_RSA_AES_128_CBC_SHA1 0x00, 0x33 TLS1.0 as possible candidates. If the server has no preference then we negotiate TLS_RSA_AES_256_GCM_SHA384. It would be ideal to send first the DHE ciphers and then the non-DHE ciphers. The ECDHE cipher come first so it would be make sense to send the DHE ciphers before the plain RSA. There is documentation how the ciphers can be overriden but this does not work as I would expect it. Or I failed at somepoint. I added: |$ cat /etc/gnutls/config |[priorities] |SYSTEM = PFS:SECURE128:SECURE192 |NORMAL = PFS:SECURE128:SECURE192 but the output of gnutls-cli --list --priority NORMAL remains unchanged. However using gnutls-cli --list --priority @NORMAL gives me the PFS ones fist since the application uses NORMAL by default, this does not help (as by chaning system defaults). Could the DHE ciphers please be moved up (preferable 1.2 ciphers first, followed by 1.0 but I guess this makes no change unless ciphers were removed on the remote side) in the default ciphers list? Using a config file would work (I guess) but having this by default would be better security wise I suppose. Sebastian
--- End Message ---
--- Begin Message ---On 2019-11-21 Sebastian Andrzej Siewior <[email protected]> wrote: > control: forwarded -1 https://gitlab.com/gnutls/gnutls/issues/862 > On 2019-11-19 19:46:07 [+0100], Andreas Metzler wrote: >> On 2019-11-18 Sebastian Andrzej Siewior <[email protected]> wrote: >> [request for changing cipher list] >> Could you please take this upstream? This is not a point where Debian >> will choose different defaults than upstream. > done. Thank you. Closing, like the upstream bug. Let's quote the rationale: | It is intentional that DHE-RSA is after RSA. The DHE-RSA ciphersuites | have several issues under tls1.2 or earlier and the most important is | that it in libraries like gnutls which enforce a consistent security | level, they make it impossible for a client to recover from a server | which sends a DH key which is below the bar. That is, unfortunately a | very common misconfiguration, and this is why RSA is preferred to DHE. See also: https://www.gnutls.org/faq.html#prime-not-acceptable
--- End Message ---
