<div dir="ltr">Thanks Jakob. Thanks a lot.</div><br><div class="gmail_quote"><div dir="ltr">On Wed, Nov 21, 2018 at 10:58 PM Jakob Bohm via openssl-users <<a href="mailto:openssl-users@openssl.org">openssl-users@openssl.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I think you missed the following:<br>
<br>
Because CBC is the oldest block cipher mode in SSL and<br>
TLS, the cipher suites using CBC don't include the<br>
letters "CBC" in their names.They simply don't mention<br>
a different mode (such as GCM or CCM).<br>
<br>
For example ECDHE-RSA-AES128-SHA uses AES128 in CBC mode.<br>
<br>
On 20/11/2018 10:54, ASHIQUE CK wrote:<br>
> Hi,<br>
> Any replys ?<br>
><br>
> On Mon, Nov 19, 2018 at 11:39 AM ASHIQUE CK <<a href="mailto:ckashiquekvk@gmail.com" target="_blank">ckashiquekvk@gmail.com</a> <br>
> <mailto:<a href="mailto:ckashiquekvk@gmail.com" target="_blank">ckashiquekvk@gmail.com</a>>> wrote:<br>
><br>
> Also I use OpenSSL 1.1.0h.<br>
><br>
> On Mon, Nov 19, 2018 at 11:36 AM ASHIQUE CK<br>
> <<a href="mailto:ckashiquekvk@gmail.com" target="_blank">ckashiquekvk@gmail.com</a> <mailto:<a href="mailto:ckashiquekvk@gmail.com" target="_blank">ckashiquekvk@gmail.com</a>>> wrote:<br>
><br>
> No, We use Ubuntu 16.04 OS<br>
><br>
> On Mon, Nov 19, 2018 at 11:34 AM Dmitry Belyavsky<br>
> <<a href="mailto:beldmit@gmail.com" target="_blank">beldmit@gmail.com</a> <mailto:<a href="mailto:beldmit@gmail.com" target="_blank">beldmit@gmail.com</a>>> wrote:<br>
><br>
> Do you use any RedHat-based OS?<br>
><br>
> On Mon, Nov 19, 2018 at 8:54 AM ASHIQUE CK<br>
> <<a href="mailto:ckashiquekvk@gmail.com" target="_blank">ckashiquekvk@gmail.com</a> <mailto:<a href="mailto:ckashiquekvk@gmail.com" target="_blank">ckashiquekvk@gmail.com</a>>><br>
> wrote:<br>
><br>
> Is it the problem with that strings or TLS/SSL<br>
> version or any other ?<br>
><br>
> On Mon, Nov 19, 2018 at 11:12 AM ASHIQUE CK<br>
> <<a href="mailto:ckashiquekvk@gmail.com" target="_blank">ckashiquekvk@gmail.com</a><br>
> <mailto:<a href="mailto:ckashiquekvk@gmail.com" target="_blank">ckashiquekvk@gmail.com</a>>> wrote:<br>
><br>
> Hi,<br>
> I had given all the cipher strings<br>
> for "SSL_CTX_set_cipher_list" which we get under<br>
> the command 'openssl ciphers' that includes CBC,<br>
> but any of them didnot worked. All of them showed<br>
> the error "error:141640B5:SSL<br>
> routines:tls_construct_client_hello:no ciphers<br>
> available". I have used TLSv1_2 or SSLv23.<br>
> Also I have tried setting these strings for<br>
> "SSLCipherSuite" at apache server configuration.<br>
> But it makes no change for choosing the server<br>
> default ciphersuit "ECDHE-RSA-AES256-GCM-SHA384".<br>
><br>
> Thanks<br>
><br>
> On Fri, Nov 16, 2018 at 9:15 PM Viktor Dukhovni<br>
> <<a href="mailto:openssl-users@dukhovni.org" target="_blank">openssl-users@dukhovni.org</a><br>
> <mailto:<a href="mailto:openssl-users@dukhovni.org" target="_blank">openssl-users@dukhovni.org</a>>> wrote:<br>
><br>
><br>
><br>
> > On Nov 16, 2018, at 7:45 AM, ASHIQUE CK<br>
> <<a href="mailto:ckashiquekvk@gmail.com" target="_blank">ckashiquekvk@gmail.com</a><br>
> <mailto:<a href="mailto:ckashiquekvk@gmail.com" target="_blank">ckashiquekvk@gmail.com</a>>> wrote:<br>
> ><br>
> > Does SSL connection supports AESCBC?<br>
><br>
> Yes, but not under that name.<br>
><br>
> > I could not set AESCBC in<br>
> "SSL_CTX_set_cipher_list" at client side or in<br>
> "SSLCipherSuite" at apache server side.<br>
><br>
> For example (constrained also to RSA and ECDHE<br>
> to keep the list short):<br>
><br>
> $ openssl ciphers -v<br>
> 'AES128+aRSA+kECDHE:!AESGCM'<br>
> ECDHE-RSA-AES128-SHA256 TLSv1.2 Kx=ECDH<br>
> Au=RSA Enc=AES(128) Mac=SHA256<br>
> ECDHE-RSA-AES128-SHA TLSv1 Kx=ECDH Au=RSA<br>
> Enc=AES(128) Mac=SHA1<br>
><br>
> There isn't a cipherlist property that<br>
> specifically selects CBC, so to<br>
> get *only* CBC, you need to exclude AESGCM<br>
> (and perhaps also AESCCM).<br>
><br>
Enjoy<br>
<br>
Jakob<br>
-- <br>
Jakob Bohm, CIO, Partner, WiseMo A/S. <a href="https://www.wisemo.com" rel="noreferrer" target="_blank">https://www.wisemo.com</a><br>
Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10<br>
This public discussion message is non-binding and may contain errors.<br>
WiseMo - Remote Service Management for PCs, Phones and Embedded<br>
<br>
-- <br>
openssl-users mailing list<br>
To unsubscribe: <a href="https://mta.openssl.org/mailman/listinfo/openssl-users" rel="noreferrer" target="_blank">https://mta.openssl.org/mailman/listinfo/openssl-users</a><br>
</blockquote></div>