<div dir="ltr">After enabling tls1.3, and uncommenting<div> <span style="color:rgb(80,0,80);font-size:12.8px">//meth = isClient ? TLS_client_method() : TLS_server_method();</span></div><div><span style="color:rgb(80,0,80);font-size:12.8px"><br></span></div><div><font color="#500050"><span style="font-size:12.8px">the handshake does succeed. </span></font></div><div><font color="#500050"><span style="font-size:12.8px"><br></span></font></div><div><font color="#500050"><span style="font-size:12.8px">The client version is still TLS 1.2, but it does contain the cipher suite configured.</span></font></div><div><font color="#500050"><span style="font-size:12.8px">Confirmed this using the TLS 1.3 version of wireshark.</span></font></div><div><font color="#500050"><span style="font-size:12.8px">The Server is responding with a Hello Retry request with TLS 1.3. The RFC says that this is caused by a mismatched configuration.</span></font></div><div><font color="#500050"><span style="font-size:12.8px">The client hello contains the Key Share Extension - with group x22519.</span></font></div><div><font color="#500050"><span style="font-size:12.8px"><br></span></font></div><div><font color="#500050"><span style="font-size:12.8px">Looking into how to configure the groups so that the Server does not need to send a Hello Retry request.</span></font></div><div><font color="#500050"><span style="font-size:12.8px"><br></span></font></div><div><font color="#500050"><span style="font-size:12.8px">Thanks,<br>Mahesh</span></font></div><div><font color="#500050"><span style="font-size:12.8px"><br></span></font></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Sep 18, 2017 at 7:56 AM, Matt Caswell <span dir="ltr"><<a href="mailto:matt@openssl.org" target="_blank">matt@openssl.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Sorry for the slightly slow response on this. I am away this week travelling (<a href="https://www.openssl.org/blog/blog/2017/08/28/china/" rel="noreferrer" target="_blank">https://www.openssl.org/blog/<wbr>blog/2017/08/28/china/</a>).<br>
<br>
Some comments inserted below.<br>
<span class=""><br>
On Mon, 18 Sep 2017 07:25:18 -0700<br>
Mahesh Bhoothapuri <<a href="mailto:maheshbhooth@gmail.com">maheshbhooth@gmail.com</a>> wrote:<br>
<br>
> Thanks for responding. Yes, I have done the steps mentioned above. Here<br>
> are my settings:<br>
><br>
> int min_version = TLS1_3_VERSION, max_version = TLS1_3_VERSION;<br>
><br>
> meth = isClient ? tlsv1_3_client_method() : tlsv1_3_server_method();<br>
<br>
</span>This is *not* correct. These are internal functions that are not exposed via the public header files or exported by the library. You should not be using them at all.<br>
<span class=""><br>
> //meth = isClient ? TLS_client_method() : TLS_server_method();<br>
<br>
</span>This commented out line is corret.<br>
<br>
In a private email to me you stated that you are not using enable-tls1_3. You absolutely *must* use that to get TLSv1.3 working.<br>
<span class=""><br>
><br>
> //////////////////////////////<wbr>/////////////////////////////<br>
> // Create new SSL context using the chosen SSL_METHOD<br>
> ctx = SSL_CTX_new(meth);<br>
> if (ctx == NULL)<br>
> {<br>
> // throw error<br>
> }<br>
><br>
> if (SSL_CTX_set_min_proto_<wbr>version(ctx, min_version) == 0)<br>
> {<br>
> // throw error<br>
> }<br>
><br>
> if (SSL_CTX_set_max_proto_<wbr>version(ctx, max_version) == 0)<br>
> {<br>
> // throw error<br>
> }<br>
><br>
> // Configure SSL to use the cipher suite specified<br>
> // TLS1_3_TXT_AES_128_GCM_SHA256<br>
> // ./include/openssl/tls1.h:# define<br>
> TLS1_3_TXT_AES_128_GCM_SHA256 "TLS13-AES-128-GCM-SHA256"<br>
> int set_cipher;<br>
> if (! (set_cipher = SSL_CTX_set_cipher_list(ctx, cipherSuite.c_str())) )<br>
> {<br>
> throw (InvalidTestConfiguration("<wbr>OpenSslApi::<wbr>OpenSslInitContext",<br>
> "Failed to set ciphers"));<br>
> }<br>
><br>
> The set_min_proto/set_max_proto calls succeed.<br>
><br>
> If I want to get the AES_128_GCM_SHA256 Cipher for TLS 1.3 to be used, are<br>
> these the steps to be used?<br>
<br>
</span>Well I can't see what cipherSuite.c_str() does, but it looks ok.<br>
<span class=""><br>
><br>
> Should I instead, select also, AES128-GCM-SHA256 a TLS 1.2 cipher in the<br>
> list, and set the min_proto to TLS 1.2, and max_proto to 1.3 ?<br>
<br>
</span>It depends. If both client and server are guaranteed to support TLSv1.3 then you don't need to support TLSv1.2 ciphersuites as well and you can set min and max to 1.3. If however you want to be able to fallback to TLSv1.2 (or below) then you should set min appropriately (to something less than 1.3).<br>
<span class=""><br>
> I need to<br>
> avoid hitting the default case below:<br>
<br>
</span>You are hitting this default case because you are not doing it right. You must not call the internal functions above. Build with enable-tls1_3 and TLS_client_method() and TLS_server_method() will start trying to negotiate TLSv1.3<br>
<br>
I believe you would benefit from reading this blog post:<br>
<br>
<a href="https://www.openssl.org/blog/blog/2017/05/04/tlsv1.3/" rel="noreferrer" target="_blank">https://www.openssl.org/blog/<wbr>blog/2017/05/04/tlsv1.3/</a><br>
<br>
Matt<br>
<div class="HOEnZb"><div class="h5"><br>
<br>
<br>
><br>
><br>
> static WRITE_TRAN ossl_statem_client13_write_<wbr>transition(SSL *s)<br>
> {<br>
> OSSL_STATEM *st = &s->statem;<br>
><br>
> /*<br>
> * Note: There are no cases for TLS_ST_BEFORE because we haven't<br>
> negotiated<br>
> * TLSv1.3 yet at that point. They are handled by<br>
> * ossl_statem_client_write_<wbr>transition().<br>
> */<br>
> switch (st->hand_state) {<br>
> default:<br>
><br>
><br>
><br>
> "<br>
><br>
><br>
><br>
><br>
> On Mon, Sep 18, 2017 at 5:40 AM, Benjamin Kaduk <<a href="mailto:bkaduk@akamai.com">bkaduk@akamai.com</a>> wrote:<br>
><br>
> > On 09/18/2017 01:07 AM, Mahesh Bhoothapuri wrote:<br>
> ><br>
> > Hi,<br>
> ><br>
> > I am sending a Tls 1.3 client hello, and am seeing an issue with<br>
> ><br>
> > ossl_statem_client_write_<wbr>transition in statem_clnt.c.<br>
> ><br>
> ><br>
> > /*<br>
> > * Note that immediately before/after a ClientHello we don't know what<br>
> > * version we are going to negotiate yet, so we don't take this branch<br>
> > until<br>
> > * later<br>
> > */<br>
> ><br>
> > /*<br>
> > * ossl_statem_client_write_<wbr>transition() works out what handshake state to<br>
> > * move to next when the client is writing messages to be sent to the<br>
> > server.<br>
> > */<br>
> > WRITE_TRAN ossl_statem_client_write_<wbr>transition(SSL *s)<br>
> > {<br>
> ><br>
> > if (SSL_IS_TLS13(s))<br>
> > return ossl_statem_client13_write_<wbr>transition(s);<br>
> > }<br>
> ><br>
> > And in:<br>
> ><br>
> ><br>
> > /*<br>
> > * ossl_statem_client_write_<wbr>transition() works out what handshake state to<br>
> > * move to next when the client is writing messages to be sent to the<br>
> > server.<br>
> > */<br>
> > WRITE_TRAN ossl_statem_client_write_<wbr>transition(SSL *s)<br>
> > {<br>
> ><br>
> > /*<br>
> > * Note: There are no cases for TLS_ST_BEFORE because we haven't<br>
> > negotiated<br>
> > * TLSv1.3 yet at that point. They are handled by<br>
> > * ossl_statem_client_write_<wbr>transition().<br>
> > */<br>
> ><br>
> > switch (st->hand_state) {<br>
> > default:<br>
> > /* Shouldn't happen */<br>
> > return WRITE_TRAN_ERROR;<br>
> ><br>
> > }<br>
> ><br>
> > With a TLS 1.3 client hello, using tls 1.3 version, the st->hand_state is<br>
> ><br>
> ><br>
> > Sorry, I just want to clarify what you are doing -- are you taking<br>
> > SSL_CTX_new(TLS_method()) and then calling SSL_CTX_set_min_proto_version(<wbr>ctx,<br>
> > TLS1_3_VERSION) and SSL_CTX_set_max_proto_version(<wbr>ctx, TLS1_3_VERSION)?<br>
> ><br>
> > I note that there is no version-specific TLSv1_3_method() available, and<br>
> > in any case, it's of questionable wisdom to attempt to force TLS 1.3 only<br>
> > while the specification is still in draft status -- in any case where the<br>
> > client and server implementations are not tightly controlled, negotiation<br>
> > failures seem quite likely.<br>
> ><br>
> > TLS_ST_BEFORE and so, the default error is returned.<br>
> ><br>
> > When I added :<br>
> ><br>
> > case TLS_ST_BEFORE:<br>
> > st->hand_state = TLS_ST_CW_CLNT_HELLO;<br>
> > return WRITE_TRAN_CONTINUE;<br>
> ><br>
> ><br>
> > The reason there is not currently a case for TLS_ST_BEFORE is that whether<br>
> > or not we're going to be using TLS 1.3 is supposed to be determined on the<br>
> > server as part of version negotiation, so when we're sending a ClientHello,<br>
> > our version is in an indeterminate status -- the general-purpose TLS method<br>
> > must be used at that part of the handshake.<br>
> ><br>
> > The client hello gets sent out, but I only saw a TLS 1.2 version being<br>
> > sent.<br>
> > Is this a bug?<br>
> ><br>
> ><br>
> > The legacy_version field in a TLS 1.3 ClientHello will be 0x0303, matching<br>
> > the historical value for TLS 1.2. The actual list of versions are conveyed<br>
> > in a "supported_versions" extension, which is what you need to be looking<br>
> > at.<br>
> ><br>
> > -Ben<br>
> ><br>
<br>
<br>
</div></div><span class="HOEnZb"><font color="#888888">--<br>
Matt Caswell <<a href="mailto:matt@openssl.org">matt@openssl.org</a>><br>
</font></span></blockquote></div><br></div>