[openssl-users] Query on API availability for openssl versions

[Jakob Bohm]

The security levels are simply a classification of the cipher
suites by quality.  Typically one would select all ciphers above
a certain level.

Most cipher suites work with all protocol levels >= a certain
level, with SSL2 (dead) and TLS1.3 (future) being exceptions.
Selecting something like "TLS1.1" in the cipher suite list simply
selects those cipher suites that were new in TLS1.1, it does not
actually select the TLS1.1 protocol.

On 17/10/2017 11:01, Grace Priscilla Jero wrote:
> Thank you Matt for the quick response.
> For "2," does it mean that every cipher suite can operate in multiple 
> levels?
> I thought that there were specific set of cipher suites operating in 
> each of the levels.
>
> Thanks,
> Grace
>
> On Tue, Oct 17, 2017 at 2:25 PM, Matt Caswell <matt at openssl.org 
> <mailto:matt at openssl.org>> wrote:
>
>
>
>     On 17/10/17 09:21, Grace Priscilla Jero wrote:
>     > Hi All,
>     >
>     > 1)
>     > The below APIs used to set the maximum and minimum versions are
>     > available in 1.1.0f version of OPENSSL.
>     >
>     >  int SSL_CTX_set_min_proto_version(SSL_CTX *ctx, int version);
>     >  int SSL_CTX_set_max_proto_version(SSL_CTX *ctx, int version);
>     >  int SSL_set_min_proto_version(SSL *ssl, int version);
>     >  int SSL_set_max_proto_version(SSL *ssl, int version);
>     >
>     >  Do you have the same in any of the 1.0.2x threads or plan to
>     have it in
>     > any later versions. We don't see it available in 1.0.2k or 1.0.2l
>     > versions. Kindly update us on the same.
>
>     These APIs were first introduced into 1.1.0, and we intend to continue
>     to support them moving forward in future versions. However they
>     will not
>     be backported to the 1.0.2 branch. We do not add new features to a
>     stable branch.
>
>     In 1.0.2 you must use the options SSL_OP_NO_SSLv3, SSL_OP_NO_TLSv1,
>     SSL_OP_NO_TLSv1_1 and SSL_OP_NO_TLSv1_2 via the
>     SSL_CTX_set_options() or
>     SSL_set_options() functions.
>
>
>     >
>     > 2)
>     > There are a set of APIs to set/get security level wherein each level
>     > supports a set of cipher suites. Is there something available in
>     OPENSSL
>     > wherein I can get the level and set it when I provide a cipher
>     suite.
>     > We have a case where we give the user a provision to provide his own
>     > list of cipher suites and we need to set the appropriate level
>     in the
>     > API so that we support it for the connections. Kindly provide
>     your comments.
>
>     You can set the security level via the cipher string using the special
>     cipher string command "@SECLEVEL". For example to set all default
>     ciphersuites at security level 2 or above you can use:
>
>     "DEFAULT:@SECLEVEL=2"
>

-- 
Jakob Bohm, CIO, partner, WiseMo A/S. https://www.wisemo.com
Transformervej 29, 2860 Soborg, Denmark. direct: +45 31 13 16 10 
<tel:+4531131610>
This message is only for its intended recipient, delete if misaddressed.
WiseMo - Remote Service Management for PCs, Phones and Embedded


Enjoy

Jakob
-- 
Jakob Bohm, CIO, Partner, WiseMo A/S.  https://www.wisemo.com
Transformervej 29, 2860 Søborg, Denmark.  Direct +45 31 13 16 10
This public discussion message is non-binding and may contain errors.
WiseMo - Remote Service Management for PCs, Phones and Embedded