mainGnuTLS - Support: sr #107623, Priority string...

 
 

sr #107623: Priority string "SECURITY256" seemingly no longer supports DSA keys

Submitter:  None
Submitted:  Sun 13 Mar 2011 02:53:21 PM UTC
   
 
Category:  None Priority:  5 - Normal
Severity:  4 - Important Status:  Done
Privacy:  Public Assigned to:  nmav
Originator Email:  -email is unavailable- Open/Closed:  Closed
Operating System:  GNU/Linux
* Mandatory Fields

Add a New Comment Rich Markup
   

Tue 15 Mar 2011 10:59:04 PM UTC, comment #1: 

Hello,
 I've committed a fix that might solve your issue. The commit is at: http://git.savannah.gnu.org/gitweb/?p=gnutls.git
Patches:
http://git.savannah.gnu.org/gitweb/?p=gnutls.git;a=commitdiff;h=c5f804fa369d493d9587a51b7a262ced7b378811
http://git.savannah.gnu.org/gitweb/?p=gnutls.git;a=commitdiff;h=67cc6539269fe8dbe6b0c436dcbc4033c92fa0dd
http://git.savannah.gnu.org/gitweb/?p=gnutls.git;a=commitdiff;h=946ad46eb1ed66e5c48b881e20fd2464af7e81f8

However some notes. Gnutls prefers openpgp keys to have a DSA or RSA subkey (ELG is not supported by TLS and using the master key is not wise). Moreover DSA keys of more than 1024 bits are not very well defined in the TLS protocol. The missing parts are filled in by gnutls and thus might not interoperate correctly with other implementations. If you want to be on the safe side either use DSA-1024 or RSA of any size.

Please let me know if the patches solve your issue.


Nikos Mavrogiannopoulos <nmav>
Group administrator
Sun 13 Mar 2011 02:53:21 PM UTC, original submission:  

If DSA keys are used, the priority string "SECURE256" no longer yields a successful handshake.  Steps to reproduce:

########
mkdir /tmp/keydir

cat > /tmp/keydir/batch <<EOF
Key-Type: DSA
Key-Length: 2048
Subkey-Type: ELG-E
Subkey-Length: 2048
Name-Real: localhost
Expire-Date: 0
%commit
EOF

gpg --quiet --batch --no-tty --no-options --enable-dsa2 --homedir /tmp/keydir --trust-model always --gen-key /tmp/keydir/batch

gpg --quiet --batch --no-tty --no-options --enable-dsa2 --homedir /tmp/keydir --armor --export-options export-minimal --comment "Test key for GnuTLS" --output /tmp/keydir/seckey.txt --export-secret-keys
gpg --quiet --batch --no-tty --no-options --enable-dsa2 --homedir /tmp/keydir --armor --export-options export-minimal --comment "Test key for GnuTLS" --output /tmp/keydir/pubkey.txt --export

gnutls-serv --priority 'SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP' --pgpkeyfile /tmp/keydir/seckey.txt --pgpcertfile /tmp/keydir/pubkey.txt --port 5556

# Now, in another terminal, run this:

gnutls-cli --insecure --priority 'SECURE256:!CTYPE-X.509:+CTYPE-OPENPGP' --port 5556 localhost
########

The server produces these error messages:
Error in handshake
Error: An unknown public key algorithm was encountered.

This used to work in GnuTLS 2.8.6.  If I change the SECURE256 to SECURE128 (on both server and client) it works, and also if I add ":!VERS-TLS1.2".  However both of those "solutions" feel suboptimal.

/Teddy Hogeborn

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by nmav (Posted a comment)
  • -email is unavailable- added by None (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2011-03-26 nmav StatusIn Progress Done
        Open/ClosedOpen Closed
    2011-03-15 nmav StatusNone In Progress
        Assigned toNone nmav

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code