1

I am trying to do a secure connection with openSSL between a client and a server that I wrote.

When I try to select the cipher suite to use, I do SSL_CTX_set_cipher_list(ctx, ECDH-ECDSA-AES18-GCM-SHA256) and this both on the client and the server.

But when I check with get_cipher_list, the cipher at priority level 0 is ECDH-RSA-AES128-GCM-SHA256 (notice the use of RSA instead of ECDSA), with ECDH-ECDSA-AES18-GCM-SHA256 only appearing at level 1.

Both client and server have ECDSA keys in certificates signed by an ECDSA CA.

I now have several questions:

  • where does the suite with RSA come from? none of server or client selected it as a possible cipher.

  • Is it possible to have the ECDSA at priority 0?

  • more troubling: when I call SSL_get_cipher(ssl) it indicates that the actual cipher used is the one with RSA. However, I was able to communicate between client and server. How is that possible if they don't have an RSA certificate?
  • Then, how can I be sure that the traffic is effectively encrypted?
4
  • Check the communication handshake with Wireshark
    – zakjan
    Feb 5, 2015 at 16:15
  • Are you sure the server is configured properly? They might have DSA keys, but if it's not configured to use DSA then it won't. As @zakjan said, check the handshake with Wireshark to see what certificate is actually being used.
    – RoraΖ
    Feb 5, 2015 at 16:36
  • Thanks for the replies. There's no DSA. Everything is ECDSA.
    – Jacques
    Feb 5, 2015 at 18:33
  • s/DSA/ECDSA in my previous post
    – RoraΖ
    Feb 5, 2015 at 20:27

1 Answer 1

1

(I assume both the AES18 are typos for AES128.)

Some early releases of OpenSSL 1.0.1 had a bug that caused a few of the new entries in the cipher table including this one to be selected incorrectly. Using patch e (Feb 2013) or later should fix it. (Or 1.0.2, just released a few weeks ago.) If interested you can see the issue by diffing ssl/s3_lib.c between versions.

If you got a connection to the server using an RSA suite, the server does have an RSA cert. Remember it is entirely possible for a server to have key&cert(s) for more than one algorithm and choose the appropriate one for the ciphersuite negotiated with a client; OpenSSL library server in particular can have RSA, DSA, DH and EC (which can be either ECDSA or ECDH). (Plus GOST, an optional Russian algorithm rarely used elsewhere.)

Aside: do you really want ECDH not ECDHE? Only the latter provides forward secrecy.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .