Cipher suite is different in “client hello” for the same code running on different platforms

Question

I'm facing a "Alert: handshake failure (40)" error when trying to establish a TLS connection. The error only happens when I run the same application on cloud, it works when I run the application on HPG8 server. OS is the same Redhat 7. By checking into the traces, I found that the cipher suite in "client hello" is much less in the error case than the worked case, and the cipher suite that TLS server supported is just missed in the "client hello" of the error case. I want to know what will impact the cipher suite that contains in the "client hello"?

The openssl version is the same (1.1.1d) for both cases, Redhat version has small difference. TLS1.2 is used. The key file and cert file are also the same.

In the code, I'm using SSL_set_cipher_list to set the cipher string as "ALL:!DH:!EXP:!RC4:@STRENGTH".

SSL_set_cipher_list(ssl, "ALL:!DH:!EXP:!RC4:@STRENGTH");

I also checked the source code of openssl, but didn't find much clue.

Cipher suite in the failure case:

Cipher Suites (25 suites)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca9)
    Cipher Suite: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca8)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 (0xc0af)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CCM (0xc0ad)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384 (0xc05d)
    Cipher Suite: TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384 (0xc061)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a)
    Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)
    Cipher Suite: TLS_RSA_WITH_AES_256_CCM_8 (0xc0a1)
    Cipher Suite: TLS_RSA_WITH_AES_256_CCM (0xc09d)
    Cipher Suite: TLS_RSA_WITH_ARIA_256_GCM_SHA384 (0xc051)
    Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035)
    Cipher Suite: TLS_RSA_WITH_CAMELLIA_256_CBC_SHA (0x0084)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 (0xc0ae)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CCM (0xc0ac)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256 (0xc05c)
    Cipher Suite: TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256 (0xc060)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009)
    Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)
    Cipher Suite: TLS_RSA_WITH_AES_128_CCM_8 (0xc0a0)
    Cipher Suite: TLS_RSA_WITH_AES_128_CCM (0xc09c)
    Cipher Suite: TLS_RSA_WITH_ARIA_128_GCM_SHA256 (0xc050)
    Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f)
    Cipher Suite: TLS_RSA_WITH_CAMELLIA_128_CBC_SHA (0x0041)
    Cipher Suite: TLS_EMPTY_RENEGOTIATION_INFO_SCSV (0x00ff)

Cipher suite for successful case (0xc02f is the suite that server returned in "server hello"):

Cipher Suites (45 suites)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (0xc02c)
    Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca9)
    Cipher Suite: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca8)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 (0xc0af)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CCM (0xc0ad)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384 (0xc05d)
    Cipher Suite: TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384 (0xc061)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 (0xc024)
    Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 (0xc073)
    Cipher Suite: TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 (0xc077)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a)
    Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)
    Cipher Suite: TLS_RSA_WITH_AES_256_GCM_SHA384 (0x009d)
    Cipher Suite: TLS_RSA_WITH_AES_256_CCM_8 (0xc0a1)
    Cipher Suite: TLS_RSA_WITH_AES_256_CCM (0xc09d)
    Cipher Suite: TLS_RSA_WITH_ARIA_256_GCM_SHA384 (0xc051)
    Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA256 (0x003d)
    Cipher Suite: TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 (0x00c0)
    Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035)
    Cipher Suite: TLS_RSA_WITH_CAMELLIA_256_CBC_SHA (0x0084)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b)
    Cipher Suite: **TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256** (0xc02f)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 (0xc0ae)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CCM (0xc0ac)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256 (0xc05c)
    Cipher Suite: TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256 (0xc060)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 (0xc023)
    Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 (0xc072)
    Cipher Suite: TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 (0xc076)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009)
    Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)
    Cipher Suite: TLS_RSA_WITH_AES_128_GCM_SHA256 (0x009c)
    Cipher Suite: TLS_RSA_WITH_AES_128_CCM_8 (0xc0a0)
    Cipher Suite: TLS_RSA_WITH_AES_128_CCM (0xc09c)
    Cipher Suite: TLS_RSA_WITH_ARIA_128_GCM_SHA256 (0xc050)
    Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA256 (0x003c)
    Cipher Suite: TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 (0x00ba)
    Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f)
    Cipher Suite: TLS_RSA_WITH_SEED_CBC_SHA (0x0096)
    Cipher Suite: TLS_RSA_WITH_CAMELLIA_128_CBC_SHA (0x0041)
    Cipher Suite: TLS_RSA_WITH_IDEA_CBC_SHA (0x0007)
    Cipher Suite: TLS_EMPTY_RENEGOTIATION_INFO_SCSV (0x00ff)

So, that seems to indicate that the available suites on the client are different. — schroeder, Commented Apr 28, 2020 at 7:48
ibm.com/support/knowledgecenter/en/SSFKSJ_7.1.0/com.ibm.mq.doc/… — schroeder, Commented Apr 28, 2020 at 7:50
Thanks. By "available suites", do you mean the suites listed by "openssl ciphers". Actually the result is the same on both platforms. — HarryH, Commented Apr 28, 2020 at 8:46
Do you get different results running openssl ciphers with 'ALL:!DH:!EXP:!RC4:@STRENGTH' argument? Did you try openssl s_client instead of your program? Did you compare openssl.cnf? Does your openssl on the cloud use an engine, or some other way to customize it? Is the cloud server special in some way (e.g. ARM chip, crypto accelerator, etc)? Did you ask the cloud vendor's support? AES _CCM present, ARIA_GCM present, AES_GCM absent is weird. I would suspect someone patched openssl in a buggy way. — Z.T., Commented Apr 28, 2020 at 11:27
RHEL7 should have openssl 1.0.2, not openssl 1.1.1. I think you have openssl from a third party repo or even compiled on the machine. Verify your openssl (the libraries loaded by dynamic linker, not just the command line tool) is really from red hat. — Z.T., Commented Apr 28, 2020 at 11:31

user163495user163495 · Accepted Answer · 2020-04-28 08:22:59Z

2

This is expected behavior.

The TLS connection begins with a ClientHello, in which the client advertises to the server which cipher suites it supports. The server must then reply with a ServerHello, in which the server picks one of these cipher suites.

The server can either honor the priorities of the client and pick the cipher the client prioritizes the most, or the server can select the cipher that the server prioritizes the most. There are different schools of thought as to whether or not a server should honor a client's preference.

Supporters of the client cipher order state that the client knows best which ciphers will work well on their platform (e.g. which ciphers have efficient hardware implementations) and which ciphers don't work so well.

Supporters of the server cipher order state that clients should generally not be trusted, and clients would pick TLS_NULL_WITH_NULL_NULL for the great performance it offers.

answered Apr 28, 2020 at 8:22

user163495

Thanks. I know this is expected behavior. But I'm not clear that how the cipher suite is determined on different hardware? With all the other factors same. Is there any configuration file for that? From openssl, the available cipher suites are the same.
– HarryH
Commented Apr 28, 2020 at 8:30
1

The SSL/TLS library used on both platforms is configured differently, even if the underlying OS is the same.
– user163495
Commented Apr 28, 2020 at 8:33
Do you mean the configuration of openssl? The product I'm working on is a big application and it is put in a archive zip and deployed on different hardware, so almost all the configuration is the same. Do you have any suggestion that what configuration I can check? Thanks.
– HarryH
Commented Apr 28, 2020 at 8:44
@HarryH That's a tricky question, depends on the exact library being used, etc.. I would recommend writing a MCVE and posting it on Stack Overflow
– user163495
Commented Apr 28, 2020 at 8:46
Thanks, I will try to write a MCVE and test that.
– HarryH
Commented Apr 28, 2020 at 9:33

| Show 1 more comment

Stack Exchange Network

Cipher suite is different in “client hello” for the same code running on different platforms

1 Answer 1

This is expected behavior.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged
tls
openssl
.

Hot Network Questions

Cipher suite is different in “client hello” for the same code running on different platforms

1 Answer 1

This is expected behavior.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged tlsopenssl.

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
tls
openssl
.