0

When I run the following command on Windows 10 with OpenSSL 1.0.2p installed I receive a curious result back (Formatted for readability):

openssl ciphers "DH+AES:!DSS:!aDSS:!aNULL"

DH-DSS-AES256-GCM-SHA384
DH-RSA-AES256-GCM-SHA384
DHE-RSA-AES256-GCM-SHA384
DHE-RSA-AES256-SHA256
DH-RSA-AES256-SHA256
DH-DSS-AES256-SHA256
DHE-RSA-AES256-SHA
DH-RSA-AES256-SHA
DH-DSS-AES256-SHA
DH-DSS-AES128-GCM-SHA256
DH-RSA-AES128-GCM-SHA256
DHE-RSA-AES128-GCM-SHA256
DHE-RSA-AES128-SHA256
DH-RSA-AES128-SHA256
DH-DSS-AES128-SHA256
DHE-RSA-AES128-SHA
DH-RSA-AES128-SHA
DH-DSS-AES128-SHA

This issue seems to only occur for non-ephemeral implementations of DH (There is no DHE-DSS-... in the list of ciphers). I'd like to use Diffie-Hellman ciphers without using DSS. Is there a way to configure OpenSSL to honor this?

1 Answer 1

1

From the documentation of ciphers:

aDSS, DSS
cipher suites using DSS authentication, i.e. the certificates carry DSS keys.

To have a closer look at the ciphers you wonder about:

$ openssl ciphers -V 'DH+AES:!DSS:!aDSS:!aNULL' | grep DSS
      0x00,0xA5 - DH-DSS-AES256-GCM-SHA384 TLSv1.2 Kx=DH/DSS   Au=DH   Enc=AESGCM(256) Mac=AEAD
      0x00,0x68 - DH-DSS-AES256-SHA256     TLSv1.2 Kx=DH/DSS   Au=DH   Enc=AES(256)    Mac=SHA256
      0x00,0x36 - DH-DSS-AES256-SHA        SSLv3 Kx=DH/DSS     Au=DH   Enc=AES(256)    Mac=SHA1
      0x00,0xA4 - DH-DSS-AES128-GCM-SHA256 TLSv1.2 Kx=DH/DSS   Au=DH   Enc=AESGCM(128) Mac=AEAD
      0x00,0x3E - DH-DSS-AES128-SHA256     TLSv1.2 Kx=DH/DSS   Au=DH   Enc=AES(128)    Mac=SHA256
      0x00,0x30 - DH-DSS-AES128-SHA        SSLv3 Kx=DH/DSS     Au=DH   Enc=AES(128)    Mac=SHA1

Have a closer look at the 'Au=...' column which describes the authentication used. Clearly all of these are using Au=DH and not Au=DSS, i.e. they are not using DSS for authentication and are thus not covered by the DSS string in the ciphers setting. All of these are using DSS only within the key exchange as Kx=DH/DSS shows.

Au=DH essentially means that the certificate contains a static Diffie Hellman key as subject public key info which is used for authentication and with Kx=DH/DSS also as part of the key exchange.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .