0

We have tested our DTLS client using the openssl s_server program from OpenSSL 3.2.1. The handshake failed because we used the wrong PSK on the client. To our surprise, the server neither responded with a TLS Alert message nor did it show any meaningful debug output.

We have started the server with the following command:

openssl s_server -dtls -psk 01020304 -psk_identity dtls-psk-test -nocert -port 12345 -cipher TLS_PSK_WITH_AES_128_CCM -status_verbose -security_debug -security_debug_verbose -state

Using the -status_verbose -security_debug -security_debug_verbose -state flags, I would assume any debug output which should give a hint that the verification of the handshake Finished message failed. But instead, the server just stops responding.

Concretely, the server output looks as follows:

Using default temp DH parameters
ACCEPT
Security callback: Version=???: yes
Security callback: Version=???: yes
Security callback: Version=DTLS 1.0: no
Security callback: Version=DTLS 1.0 (bad): no
SSL_accept:before SSL initialization
SSL_accept:before SSL initialization
SSL_accept:SSLv3/TLS read client hello
SSL_accept:DTLS1 write hello verify request
SSL_accept:DTLS1 write hello verify request
Security callback: Version=???: yes
Security callback: : yes
Security callback: Supported Signature Algorithm scheme=rsa_pkcs1_sha1, security bits=64: no
Security callback: Supported Signature Algorithm digest=SHA1, algorithm=DSA, security bits=64: no
Security callback: Supported Signature Algorithm scheme=ecdsa_sha1, security bits=64: no
Security callback: Shared Ciphersuite=PSK-AES128-CCM, security bits=128: yes
SSL_accept:SSLv3/TLS read client hello
SSL_accept:SSLv3/TLS write server hello
SSL_accept:SSLv3/TLS write server done
SSL_accept:SSLv3/TLS write server done
SSL_accept:SSLv3/TLS read client key exchange

Afterwards, the client times out at some point, the server gives no indication at all that something went wrong and just times out after a relatively long time (around 5 min).

How could we get the server to send a TLS Alert message and/or show debug output which shows what went wrong?

5
  • See github.com/openssl/openssl/issues/10906 Commented May 2 at 15:15
  • Have you also tried increasing the verbosity? Commented May 2 at 16:21
  • Try adding the "-trace" option to s_server Commented May 3 at 7:05
  • @MattCaswell With the -trace option, the received Finished message is (partially) shown, but no indication is given that the verification failed.
    – Binabik
    Commented May 3 at 13:00
  • @SirMuffington How would you increase the verbosity? As far as we can tell, we have already set status and debug info to verbose and there is no way to further increase it.
    – Binabik
    Commented May 3 at 13:01

1 Answer 1

1

As pointed out in the comments, this does not seem to be possible currently. This was discussed in https://github.com/openssl/openssl/issues/10906, too.

In that discussion, it is mentioned that this is actually recommended behaviour and the corresponding section from the RFC is cited:

In general, DTLS implementations SHOULD silently discard records with bad MACs or that are otherwise invalid. They MAY log an error. If a DTLS implementation chooses to generate an alert when it receives a message with an invalid MAC, it MUST generate a bad_record_mac alert

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .