Re: [saag] AD review of draft-iab-crypto-alg-agility-06

[Viktor Dukhovni <[e-mail]>]

On Wed, Aug 26, 2015 at 01:49:56PM +0200, Eliot Lear wrote:

> On 8/25/15 6:55 PM, Viktor Dukhovni wrote:
> 
> > The nasty part is that cleartext fallback is not always desirable
> > or available.  Sendmail IIRC does not fall back after STARTTLS
> > handshake failure.
> 
> Yes that's right.  Instead you get a 403 4.7.0 TLS handshake failed. 
> This is now happening all over the place, as it turns out, due to the
> recent changes to the OpenSSL library involving dh processing.

With Logjam we don't have much choice but to break compatibility
with 512-bit DH, because we're mitigating a downgrade attack.

Are there many servers out there with 512-bit DH keys not only for
export ciphers but across the board?

Sendmail uses a single set of DH parameters, rather than one set
for export and another for non-export ciphers, and perhaps it was
not entirely uncommon to configure it to use 512-bit DH parameters
across the board.

The Sendmail DH code has incorrect assumptions and corresponding
internal documentation.  It assumes wrongly that TLS clients need
to configure DH parameters.  (Sendmail could avoid loading or
generating DH parameters when running as a client).  Sendmail should
have been using the OpenSSL DH parameter callback API, rather than
setting fixed parameters for both export and non-export ciphers.

Needless to say the TLS functionality in Sendmail does not appear
to be very actively maintained. :-(

-- 
	Viktor.