On Tue, Nov 02, 1999 at 04:27:29PM -0800, Mike Benna wrote:
> I've just now discovered that SSL_CTX_set_cipher_list() takes parameters in
> a different format than I thought. How do you add the EXP1024 ciphers that
> you mention? I've tried passing all kinds of strings to
> SSL_CTX_set_cipher_list() but with no success in limiting connections to
> 56-bit (I can get 40-bit or 64-bit+, but not 56).
Without having seen your actual coding:
- The 56bit cyphers are only compiled into OpenSSL when
TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES is set in tls1.h
- Actually, the current implementation of the cipher code is buggy with
regard to 56bit cyphers.
I have analyzed this and posted to the list about two weeks ago
in the thread "SSL Cipher Suites".
In a further discussion with Ben Laurie in private Email I volunteered
to rework these routines when coming back from a conference and I
intend to start doing the work today or tomorrow. It seems somebody is
going to add RC6 cyphers (whatever this may be :-), so I should add
support for more cyphers while on it.
> Also, can anyone explain what these things do:
> -HIGH !HIGH +HIGH -MEDIUM !MEDIUM +HIGH -LOW !LOW
> +EXP +EXPORT56
> etc.
>
> I'm a little confused about when the '+' is needed and the difference
> between ! and -.
First, all cyphers are loaded, then they are treated according the string.
The difference between '-' and '!' is not quite obvious. '-' just marks
the cypher as "not active" while "!" actually removes it from the linked
list. Hence, in both cases you cannot use it anymore after processing.
'+' is used for ordering: those cyphers matching are moved to the end
of the list.
So, the original string included in ssl.h does the following:
"ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP"
- Add all ciphers
- Remove all ciphers with ADH (anonymous DH)
- The third on I have not completely understood, seems I have to run
the debugger over it for understanding. My rough guess is: Add RC4
cyphers again and move those matching the RSA to the end !?
- Move cyphers marked with strengh "HIGH" to the end.
- Move cyphers marked with strengh "MEDIUM" to the end.
- Move cyphers marked with strengh "LOW" to the end.
At this point the ciphers are sorted from HIGH to LOW.
- Move SSLv2 ciphers to the end, they have lower priority.
Sorting is now:
..., HIGH, SSLv2 HIGH, MEDIUM, SSLv2 MEDIUM, LOW, SSLv2 LOW
- Finally, move EXPORT ciphers to the end of the list.
Sorting is now:
..., HIGH, SSLv2 HIGH, MEDIUM, SSLv2 MEDIUM, LOW, SSLv2 LOW, EXPORT
As my old analysis showed, the EXP flag does not recognize 56bit
ciphers as being "EXPORT" and EXPORT56 erronously will also touch
the NOT_EXPORT cyhpers, so that the sorting is completely messed up,
when EXPORT56 is chosen.
So much for now. Please don't hold your breath for the reworked version
I want to realize, it might take some days.
Best regards,
Lutz
--
Lutz Jaenicke [EMAIL PROTECTED]
BTU Cottbus http://www.aet.TU-Cottbus.DE/personen/jaenicke/
Lehrstuhl Allgemeine Elektrotechnik Tel. +49 355 69-4129
Universitaetsplatz 3-4, D-03044 Cottbus Fax. +49 355 69-4153
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
