Subject: RE: Verifying enabled ciphers?

From: [email-masked]
Date: Fri, 24 Jan 2003 09:30:28 -0000

Try http://www.netcraft.com/sslwhats. It will give you a list of ciphers.

To unpack the terms:
 
"allows anonymous authentication" - That sounds like allowing anyone to
visit your site, since I've never heard of anonymous auth for http, only
ftp. Of course, the evil IIS uses a specific account for "anonymous" access
(supposedly to protect your filesystem, but it's pants), which might be what
they are thinking of. 

"allows cleartext communication" - That's what you get on non-secured sites.
If the data doesn't need to be secured, there's no issue.

"supports weak encryption" - Allows older browsers that have
"export-crippled" security to connect. On the above Netcraft site, you'll
see "export version". The question for you is whether it is satisfactory to
exclude older browsers from your websites. We've decided it isn't, so we
stick with the export ciphers. It's true that they could be compromised in
some way, but if there are users out there who are using ancient browsers
then they probably have no up to date anti-virus protection either, so this
is the least of their worries.

You'll need more information about all of these one from your auditor,
rather than just sweeping statements.

We had a security auditor recently who said much the same.

- 
John Airey, BSc (Jt Hons), CNA, RHCE
Internet systems support officer, ITCSD, Royal National Institute of the
Blind,
Bakewell Road, Peterborough PE2 6XU,
Tel.: +44 (0) 1733 375299 Fax: +44 (0) 1733 370848 [email-masked] 

Nearly everything we believe is second hand. For example, less than 500
people have seen the Earth from space, yet the majority of people believe it
is round (or an oblate sphere for the pedants).

> -----Original Message-----
> From: Steve Chadsey [mailto:[email-masked]]
> Sent: 24 January 2003 02:10
> To: [email-masked]
> Subject: Verifying enabled ciphers?
> 
> 
> How can I verify the ciphers enabled by my webserver?
> 
> The reason I ask is because I have been informed by a third-party
> security auditor that my server "allows anonymous authentication",
> "allows cleartext communication", and "supports weak encryption".
> I am unable to verify any of these claims on my own.
> 
> Here is my information
> Apache: 1.3.27
> mod_ssl: mod_ssl/2.8.12-1.3.27
> openssl: openssl-0.9.6g
> OS: Solaris 8
> 
> Here are my relevant SSL directives from httpd.conf:
> SSLEngine on
> SSLCipherSuite HIGH:MEDIUM:!ADH
> SSLProtocol all -SSLv2
> 
> According to 
>   /usr/local/ssl/bin/openssl ciphers -v 'HIGH:MEDIUM:!ADH'
> the supported ciphers for my server are:
> EDH-RSA-DES-CBC3-SHA    SSLv3 Kx=DH       Au=RSA  
> Enc=3DES(168) Mac=SHA1
> EDH-DSS-DES-CBC3-SHA    SSLv3 Kx=DH       Au=DSS  
> Enc=3DES(168) Mac=SHA1
> DES-CBC3-SHA            SSLv3 Kx=RSA      Au=RSA  
> Enc=3DES(168) Mac=SHA1
> DES-CBC3-MD5            SSLv2 Kx=RSA      Au=RSA  
> Enc=3DES(168) Mac=MD5
> DHE-DSS-RC4-SHA         SSLv3 Kx=DH       Au=DSS  
> Enc=RC4(128)  Mac=SHA1
> IDEA-CBC-SHA            SSLv3 Kx=RSA      Au=RSA  
> Enc=IDEA(128) Mac=SHA1
> RC4-SHA                 SSLv3 Kx=RSA      Au=RSA  
> Enc=RC4(128)  Mac=SHA1
> RC4-MD5                 SSLv3 Kx=RSA      Au=RSA  
> Enc=RC4(128)  Mac=MD5
> IDEA-CBC-MD5            SSLv2 Kx=RSA      Au=RSA  
> Enc=IDEA(128) Mac=MD5
> RC2-CBC-MD5             SSLv2 Kx=RSA      Au=RSA  
> Enc=RC2(128)  Mac=MD5
> RC4-MD5                 SSLv2 Kx=RSA      Au=RSA  
> Enc=RC4(128)  Mac=MD5
> 
> But apparently I am also supporting:
> ADH-DES-CBC-SHA
> DES-CBC-SHA
> EDH-DSS-DES-CBC-SHA
> EDH-RSA-DES-CBC-SHA
> EXP1024-DES-CBC-SHA
> EXP1024-DHE-DSS-DES-CBC-SHA
> EXP1024-DHE-DSS-RC4-SHA
> EXP1024-RC2-CBC-MD5
> EXP1024-RC4-MD5
> EXP1024-RC4-SHA
> EXP-ADH-DES-CBC-SHA
> EXP-ADH-RC4-MD5
> EXP-DES-CBC-SHA
> EXP-EDH-DSS-DES-CBC-SHA
> EXP-EDH-RSA-DES-CBC-SHA
> EXP-RC2-CBC-MD5
> EXP-RC4-MD5
> NULL-MD5
> NULL-SHA
> 
> Is the security auditor full of it?  How can I verify their results
> from an external machine (they've scanned the network from an
> external box)?
> 
> Thanks,
> -- 
> Steve Chadsey <[email-masked]>
> ______________________________________________________________________
> Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
> User Support Mailing List                      [email-masked]
> Automated List Manager                            [email-masked]
> 

- 

NOTICE: The information contained in this email and any attachments is 
confidential and may be legally privileged. If you are not the 
intended recipient you are hereby notified that you must not use, 
disclose, distribute, copy, print or rely on this email's content. If 
you are not the intended recipient, please notify the sender 
immediately and then delete the email and any attachments from your 
system.

RNIB has made strenuous efforts to ensure that emails and any 
attachments generated by its staff are free from viruses. However, it 
cannot accept any responsibility for any viruses which are 
transmitted. We therefore recommend you scan all attachments.

Please note that the statements and views expressed in this email 
and any attachments are those of the author and do not necessarily 
represent those of RNIB.

RNIB Registered Charity Number: 226227

Website: http://www.rnib.org.uk 
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Steve Chadsey <[email-masked]>
Date: Mon, 27 Jan 2003 10:47:27 -0700

> Try http://www.netcraft.com/sslwhats. It will give you a list of ciphers.

OK.  I did that, and the only one I support is "RC4 with MD5".  Strange, I
thought I would be able to support more.  Actually, to amend my previous
post, the ones I expected to see were:

EDH-RSA-DES-CBC3-SHA 
EDH-DSS-DES-CBC3-SHA
DES-CBC3-SHA
DHE-DSS-RC4-SHA
IDEA-CBC-SHA
RC4-SHA
RC4-MD5

since I have SSLv2 shut off.  Would the above list be further limited
by the type (RSA / DSA) key I have?  It is RSA.

> "allows anonymous authentication" - That sounds like allowing anyone to

I believe they mean Anonymous Diffie-Helman.  My SSLCipherSuite line
excludes those, so I think they're wrong here.

> If the data doesn't need to be secured, there's no issue.

I believe they are referring to the NULL-MD5 cipher.  I tested that
with s_client, and I can't connect ('handshake failure'), so I don't
believe I'm supporting that one either.

> see "export version". The question for you is whether it is satisfactory to

Yeah, I include only 'HIGH' and 'MEDIUM' strength ciphers, according
to my SSLCipherSuite line.  

To follow up to Lutz, I tested all the ciphers with s_client against
my server.  The ones that I connected with were:

DES-CBC3-SHA
EDH-RSA-DES-CBC3-SHA
IDEA-CBC-SHA
RC4-MD5
RC4-SHA

This is a shorter list than what I was expecting (at the top of
this message).

The following did not connect, giving me a 'handshake failure':
ADH-DES-CBC3-SHA 
ADH-DES-CBC-SHA
ADH-RC4-MD5
DES-CBC-SHA
DHE-DSS-RC4-SHA
EDH-DSS-DES-CBC3-SHA
EDH-DSS-DES-CBC-SHA
EDH-RSA-DES-CBC-SHA
EXP1024-DES-CBC-SHA
EXP1024-DHE-DSS-DES-CBC-SHA
EXP1024-DHE-DSS-RC4-SHA
EXP1024-RC2-CBC-MD5
EXP1024-RC4-MD5
EXP1024-RC4-SHA
EXP-ADH-DES-CBC-SHA
EXP-ADH-RC4-MD5
EXP-DES-CBC-SHA
EXP-EDH-DSS-DES-CBC-SHA
EXP-EDH-RSA-DES-CBC-SHA
EXP-RC2-CBC-MD5
EXP-RC4-MD5

The following gave me 'illegal parameter':
DES-CBC3-MD5
DES-CBC-MD5
IDEA-CBC-MD5
RC2-CBC-MD5
RC4-64-MD5

Thanks,
-- 
Steve <[email-masked]>

---

From: Lutz Jaenicke <[email-masked]>
Date: Mon, 27 Jan 2003 20:52:53 +0100

> by the type (RSA / DSA) key I have?  It is RSA.

Yes, it is limited by the key. Without a DSA key, you cannot use DSS ciphers.
Therefore being left:
 EDH-RSA-DES-CBC3-SHA
 DES-CBC3-SHA
 IDEA-CBC-SHA
 RC4-SHA
 RC4-MD5

> my server.  The ones that I connected with were:

See above :-)

> The following gave me 'illegal parameter':

These ciphers are SSLv2 ciphers.

Best regards,
	Lutz
-- 
Lutz Jaenicke                             [email-masked]
http://www.aet.TU-Cottbus.DE/personen/jaenicke/
BTU Cottbus, Allgemeine Elektrotechnik
Universitaetsplatz 3-4, D-03044 Cottbus
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Steve Chadsey <[email-masked]>
Date: Thu, 30 Jan 2003 11:38:04 -0700

One more question regarding the SSLCipherSuite line.  Our security
auditor recommended that we change the line
  SSLCipherSuite HIGH:MEDIUM:!ADH
to
  SSLCipherSuite HIGH:MEDIUM:-ADH:-aNULL

What is the difference?  
  openssl ciphers -v 'HIGH:MEDIUM:!ADH'
and
  openssl ciphers -v 'HIGH:MEDIUM:-ADH:-aNULL'

both return the same cipher list.  Is there a practical difference
in the two directives?

Thanks,

---

From: Lutz Jaenicke <[email-masked]>
Date: Thu, 30 Jan 2003 19:42:40 +0100

> both return the same cipher list.  Is there a practical difference

Hmm, not now.

aNULL is equivalent to ADH, as Anonymous DH ciphers are the only aNULL
ciphers supported. If at any point in the future an anonymous cipher
without DH would be added (does such thing exist?), it might make
a difference.

Best regards,
	Lutz