[openssl] master update
Dr. Paul Dale
pauli at openssl.org
Fri Sep 24 07:39:31 UTC 2021
The branch master has been updated
via e07102220afe4059bc45aa3d7073b7678329e26e (commit)
via 56ffcce492ffc6f36b2f0d9431e23febe054dd04 (commit)
via 1a473d1cc67e04ae9fea517b36dc332143250cf5 (commit)
from c3b5fa4ab7d19e35311a21fec3ebc0a333c352b6 (commit)
- Log -----------------------------------------------------------------
commit e07102220afe4059bc45aa3d7073b7678329e26e
Author: Pauli <pauli at openssl.org>
Date: Thu Sep 23 12:27:11 2021 +1000
tls/ccm8: reduce the cipher strength for CCM8 ciphers to 64 bits
This is the length of the tag they use and should be considered an upper bound
on their strength.
This lowers their security strength to level 0.
Reviewed-by: Matt Caswell <matt at openssl.org>
Reviewed-by: Tomas Mraz <tomas at openssl.org>
(Merged from https://github.com/openssl/openssl/pull/16652)
commit 56ffcce492ffc6f36b2f0d9431e23febe054dd04
Author: Pauli <pauli at openssl.org>
Date: Wed Sep 22 10:32:49 2021 +1000
doc: document the change to the security level of CCM8 cipher suites
Reviewed-by: Matt Caswell <matt at openssl.org>
Reviewed-by: Tomas Mraz <tomas at openssl.org>
(Merged from https://github.com/openssl/openssl/pull/16652)
commit 1a473d1cc67e04ae9fea517b36dc332143250cf5
Author: Pauli <pauli at openssl.org>
Date: Wed Sep 22 10:31:22 2021 +1000
tls: reduce the strength of CCM_8 ciphers due to their short IV.
Fixes #16154
Reviewed-by: Matt Caswell <matt at openssl.org>
Reviewed-by: Tomas Mraz <tomas at openssl.org>
(Merged from https://github.com/openssl/openssl/pull/16652)
-----------------------------------------------------------------------
Summary of changes:
CHANGES.md | 5 ++++
doc/man3/SSL_CTX_set_security_level.pod | 3 ++-
ssl/s3_lib.c | 44 ++++++++++++++++-----------------
test/sslapitest.c | 34 ++++++++++++++++++-------
4 files changed, 54 insertions(+), 32 deletions(-)
diff --git a/CHANGES.md b/CHANGES.md
index c9d3825eec..84fb4c3f84 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -24,6 +24,11 @@ OpenSSL 3.1
### Changes between 3.0 and 3.1 [xx XXX xxxx]
+ * CCM8 cipher suites in TLS have been downgraded to security level zero
+ because they use a short authentication tag which lowers their strength.
+
+ *Paul Dale*
+
* Subject or issuer names in X.509 objects are now displayed as UTF-8 strings
by default.
diff --git a/doc/man3/SSL_CTX_set_security_level.pod b/doc/man3/SSL_CTX_set_security_level.pod
index 292d6a2333..d9965572c8 100644
--- a/doc/man3/SSL_CTX_set_security_level.pod
+++ b/doc/man3/SSL_CTX_set_security_level.pod
@@ -77,7 +77,8 @@ parameters offering below 80 bits of security are excluded. As a result RSA,
DSA and DH keys shorter than 1024 bits and ECC keys shorter than 160 bits
are prohibited. All export cipher suites are prohibited since they all offer
less than 80 bits of security. SSL version 2 is prohibited. Any cipher suite
-using MD5 for the MAC is also prohibited.
+using MD5 for the MAC is also prohibited. Any cipher suites using CCM with
+a 64 bit authentication tag are prohibited.
=item B<Level 2>
diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
index ef027d79e0..88565a7000 100644
--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -108,9 +108,9 @@ static SSL_CIPHER tls13_ciphers[] = {
SSL_AEAD,
TLS1_3_VERSION, TLS1_3_VERSION,
0, 0,
- SSL_NOT_DEFAULT | SSL_HIGH,
+ SSL_NOT_DEFAULT | SSL_MEDIUM,
SSL_HANDSHAKE_MAC_SHA256,
- 128,
+ 64, /* CCM8 uses a short tag, so we have a low security strength */
128,
}
};
@@ -699,9 +699,9 @@ static SSL_CIPHER ssl3_ciphers[] = {
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
- SSL_NOT_DEFAULT | SSL_HIGH,
+ SSL_NOT_DEFAULT | SSL_MEDIUM,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
- 128,
+ 64, /* CCM8 uses a short tag, so we have a low security strength */
128,
},
{
@@ -715,9 +715,9 @@ static SSL_CIPHER ssl3_ciphers[] = {
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
- SSL_NOT_DEFAULT | SSL_HIGH,
+ SSL_NOT_DEFAULT | SSL_MEDIUM,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
- 256,
+ 64, /* CCM8 uses a short tag, so we have a low security strength */
256,
},
{
@@ -731,9 +731,9 @@ static SSL_CIPHER ssl3_ciphers[] = {
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
- SSL_NOT_DEFAULT | SSL_HIGH,
+ SSL_NOT_DEFAULT | SSL_MEDIUM,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
- 128,
+ 64, /* CCM8 uses a short tag, so we have a low security strength */
128,
},
{
@@ -747,9 +747,9 @@ static SSL_CIPHER ssl3_ciphers[] = {
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
- SSL_NOT_DEFAULT | SSL_HIGH,
+ SSL_NOT_DEFAULT | SSL_MEDIUM,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
- 256,
+ 64, /* CCM8 uses a short tag, so we have a low security strength */
256,
},
{
@@ -827,9 +827,9 @@ static SSL_CIPHER ssl3_ciphers[] = {
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
- SSL_NOT_DEFAULT | SSL_HIGH,
+ SSL_NOT_DEFAULT | SSL_MEDIUM,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
- 128,
+ 64, /* CCM8 uses a short tag, so we have a low security strength */
128,
},
{
@@ -843,9 +843,9 @@ static SSL_CIPHER ssl3_ciphers[] = {
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
- SSL_NOT_DEFAULT | SSL_HIGH,
+ SSL_NOT_DEFAULT | SSL_MEDIUM,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
- 256,
+ 64, /* CCM8 uses a short tag, so we have a low security strength */
256,
},
{
@@ -859,9 +859,9 @@ static SSL_CIPHER ssl3_ciphers[] = {
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
- SSL_NOT_DEFAULT | SSL_HIGH,
+ SSL_NOT_DEFAULT | SSL_MEDIUM,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
- 128,
+ 64, /* CCM8 uses a short tag, so we have a low security strength */
128,
},
{
@@ -875,9 +875,9 @@ static SSL_CIPHER ssl3_ciphers[] = {
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
- SSL_NOT_DEFAULT | SSL_HIGH,
+ SSL_NOT_DEFAULT | SSL_MEDIUM,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
- 256,
+ 64, /* CCM8 uses a short tag, so we have a low security strength */
256,
},
{
@@ -923,9 +923,9 @@ static SSL_CIPHER ssl3_ciphers[] = {
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
- SSL_NOT_DEFAULT | SSL_HIGH,
+ SSL_NOT_DEFAULT | SSL_MEDIUM,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
- 128,
+ 64, /* CCM8 uses a short tag, so we have a low security strength */
128,
},
{
@@ -939,9 +939,9 @@ static SSL_CIPHER ssl3_ciphers[] = {
SSL_AEAD,
TLS1_2_VERSION, TLS1_2_VERSION,
DTLS1_2_VERSION, DTLS1_2_VERSION,
- SSL_NOT_DEFAULT | SSL_HIGH,
+ SSL_NOT_DEFAULT | SSL_MEDIUM,
SSL_HANDSHAKE_MAC_SHA256 | TLS1_PRF_SHA256,
- 256,
+ 64, /* CCM8 uses a short tag, so we have a low security strength */
256,
},
{
diff --git a/test/sslapitest.c b/test/sslapitest.c
index e95d2657f4..1337698e0d 100644
--- a/test/sslapitest.c
+++ b/test/sslapitest.c
@@ -4112,6 +4112,12 @@ static int test_early_data_psk_with_all_ciphers(int idx)
&serverssl, &sess, 2)))
goto end;
+ if (idx == 4) {
+ /* CCM8 ciphers are considered low security due to their short tag */
+ SSL_set_security_level(clientssl, 0);
+ SSL_set_security_level(serverssl, 0);
+ }
+
if (!TEST_true(SSL_set_ciphersuites(clientssl, cipher_str[idx]))
|| !TEST_true(SSL_set_ciphersuites(serverssl, cipher_str[idx])))
goto end;
@@ -4399,9 +4405,11 @@ static int test_ciphersuite_change(void)
"TLS_AES_256_GCM_SHA384:"
"TLS_AES_128_CCM_SHA256"))
|| !TEST_true(SSL_CTX_set_ciphersuites(cctx,
- "TLS_AES_128_GCM_SHA256"))
- || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
- &clientssl, NULL, NULL))
+ "TLS_AES_128_GCM_SHA256")))
+ goto end;
+
+ if (!TEST_true(create_ssl_objects(sctx, cctx, &serverssl, &clientssl,
+ NULL, NULL))
|| !TEST_true(create_ssl_connection(serverssl, clientssl,
SSL_ERROR_NONE)))
goto end;
@@ -4928,16 +4936,19 @@ static int test_tls13_ciphersuite(int idx)
static const struct {
const char *ciphername;
int fipscapable;
+ int low_security;
} t13_ciphers[] = {
- { TLS1_3_RFC_AES_128_GCM_SHA256, 1 },
- { TLS1_3_RFC_AES_256_GCM_SHA384, 1 },
- { TLS1_3_RFC_AES_128_CCM_SHA256, 1 },
+ { TLS1_3_RFC_AES_128_GCM_SHA256, 1, 0 },
+ { TLS1_3_RFC_AES_256_GCM_SHA384, 1, 0 },
+ { TLS1_3_RFC_AES_128_CCM_SHA256, 1, 0 },
# if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305)
- { TLS1_3_RFC_CHACHA20_POLY1305_SHA256, 0 },
+ { TLS1_3_RFC_CHACHA20_POLY1305_SHA256, 0, 0 },
{ TLS1_3_RFC_AES_256_GCM_SHA384
- ":" TLS1_3_RFC_CHACHA20_POLY1305_SHA256, 0 },
+ ":" TLS1_3_RFC_CHACHA20_POLY1305_SHA256, 0, 0 },
# endif
- { TLS1_3_RFC_AES_128_CCM_8_SHA256 ":" TLS1_3_RFC_AES_128_CCM_SHA256, 1 }
+ /* CCM8 ciphers are considered low security due to their short tag */
+ { TLS1_3_RFC_AES_128_CCM_8_SHA256
+ ":" TLS1_3_RFC_AES_128_CCM_SHA256, 1, 1 }
};
const char *t13_cipher = NULL;
const char *t12_cipher = NULL;
@@ -4981,6 +4992,11 @@ static int test_tls13_ciphersuite(int idx)
&sctx, &cctx, cert, privkey)))
goto end;
+ if (t13_ciphers[i].low_security) {
+ SSL_CTX_set_security_level(sctx, 0);
+ SSL_CTX_set_security_level(cctx, 0);
+ }
+
if (set_at_ctx) {
if (!TEST_true(SSL_CTX_set_ciphersuites(sctx, t13_cipher))
|| !TEST_true(SSL_CTX_set_ciphersuites(cctx, t13_cipher)))
More information about the openssl-commits
mailing list