I am trying to do a secure connection with openSSL between a client and a server that I wrote.

When I try to select the cipher suite to use, I do SSL_CTX_set_cipher_list(ctx, ECDH-ECDSA-AES18-GCM-SHA256) and this both on the client and the server.

But when I check with get_cipher_list, the cipher at priority level 0 is ECDH-RSA-AES128-GCM-SHA256 (notice the use of RSA instead of ECDSA), with ECDH-ECDSA-AES18-GCM-SHA256 only appearing at level 1.

Both client and server have ECDSA keys in certificates signed by an ECDSA CA.

I now have several questions:

  • where does the suite with RSA come from? none of server or client selected it as a possible cipher.

  • Is it possible to have the ECDSA at priority 0?

  • more troubling: when I call SSL_get_cipher(ssl) it indicates that the actual cipher used is the one with RSA. However, I was able to communicate between client and server. How is that possible if they don't have an RSA certificate?
  • Then, how can I be sure that the traffic is effectively encrypted?
  • Check the communication handshake with Wireshark – zakjan Feb 5 '15 at 16:15
  • Are you sure the server is configured properly? They might have DSA keys, but if it's not configured to use DSA then it won't. As @zakjan said, check the handshake with Wireshark to see what certificate is actually being used. – RoraΖ Feb 5 '15 at 16:36
  • Thanks for the replies. There's no DSA. Everything is ECDSA. – Jacques Feb 5 '15 at 18:33
  • s/DSA/ECDSA in my previous post – RoraΖ Feb 5 '15 at 20:27

(I assume both the AES18 are typos for AES128.)

Some early releases of OpenSSL 1.0.1 had a bug that caused a few of the new entries in the cipher table including this one to be selected incorrectly. Using patch e (Feb 2013) or later should fix it. (Or 1.0.2, just released a few weeks ago.) If interested you can see the issue by diffing ssl/s3_lib.c between versions.

If you got a connection to the server using an RSA suite, the server does have an RSA cert. Remember it is entirely possible for a server to have key&cert(s) for more than one algorithm and choose the appropriate one for the ciphersuite negotiated with a client; OpenSSL library server in particular can have RSA, DSA, DH and EC (which can be either ECDSA or ECDH). (Plus GOST, an optional Russian algorithm rarely used elsewhere.)

Aside: do you really want ECDH not ECDHE? Only the latter provides forward secrecy.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.