0

How to find cipher suite changes within different OpenSSL versions ? Let's assume that the OpenSSL package was update to openssl-0.9.8e-36.0.1.el5_11 and I'm able to find from release notes what was it's version prior to the upgrade. Thanks to "Steffen Ullrich I know how to run a command to list the cipher suites for the current version but is there any repository that would allow my compare both OpenSSL versions in terms of cipher suite changs?

thank you

1

Cipher suites can be enabled or disabled at compile-time, which is why you'd want to be able to run the same command against both versions of OpenSSL: so you can see what was actually compiled into the package. Someone could also have backported certain suites into (or out of) the code before compiling and releasing the packages you have. Given that long version string, you seem to have received OpenSSL from some third-party vendor (CentOS?) who is not providing vanilla OpenSSL, so the official OpenSSL changelogs won't tell you what other changes have been made: you will probably need to contact your vendor for their changelogs.

As a starting point, or if you just care about what could have been compiled in assuming the code was taken directly from OpenSSL without any changes, OpenSSL provides their changelogs by version so you can see a technical list of what was changed in each version (for example, 0.9.8c removed 3 ciphersuites and added 1).

  • 3
    That version format is RHEL, which is redistributed by CentOS and maybe others. It may matter here that RedHat until roughly 2 years ago removed ECC functionality from all crypto packages that had it, including ECC-based ciphersuites in OpenSSL, which were in fact present in vanilla/upstream 0.9.8 but in a hard to use form; only 1.0.0 and up provides them by default. – dave_thompson_085 Jul 6 '16 at 0:23
  • Thank you both for taking time to comment. When looking at the release notes I can see that OpenSSL got updated from 0.9.8e-33.el5_11 to openssl-0.9.8e-37.el5_11 in response to the following security vulnerability CVE-2015-3195. I was reviewing it but couldn't find something that would indicated cipher suite changes ... – adam86 Jul 6 '16 at 6:30
  • @adam86 The whole purpose of a "stable" release is to only fix actual defects, and not introduce new ones by adding additional features. So I wouldn't expect a minor rev like that to add or remove features (ciphers, in this case) unless those changes explicitly addressed defects. In general, if you are expecting new features you'll have to go outside of the "stable release" paradigm. But it sounds like maybe you've solved your problem by finding those release notes? If so, you could add an answer showing how you got there, and mark your answer as "accepted." – drewbenn Jul 6 '16 at 6:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.