Re: Patch for TLS 1.2 DHE* cipher support in uwimap/panda?

Neal Horman <[email protected]> Wed, 5 Apr 2017 17:42:06 -0500
Newsgroups	gmane.mail.imap.uw.c-client
Message-ID	<[email protected]>
This is a cryptographically signed message in MIME format.

--===============0259745614517068020==
Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms080406050608080103020403"

This is a cryptographically signed message in MIME format.

--------------ms080406050608080103020403
Content-Type: multipart/alternative;
 boundary="------------A0B749627E51F09187D53E86"

This is a multi-part message in MIME format.
--------------A0B749627E51F09187D53E86
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: quoted-printable

I have already applied the "ssl cipher and protocol options patch" from=20
http://www.freebsd.cz/~dan/patch-DAN-SETSSLCIPHER to my panda fork at=20
github.com/nkhorman/panda-imap/tree/ssloptions, and submitted a=20
pull-request to jonabbey/panda-imap a year ago, that is still open.

You may find it useful.

Regards
Neal Horman

On 4/5/17 5:23 PM, Erik Kangas, Ph.D. wrote:
> Thanks.
>
> We already pre-generate the DH parameters for sendmail and have them=20
> sitting around in a dhparms.pem file unique to the server.  I wonder=20
> if anyone has created a patch that allows UW IMAP to read such a file=20
> and supply the parameters?
>
> -Erik Kangas
> On April 5, 2017 06:07:15 pm EDT, "Dan Lukes" <[email protected]> wrote:
>
>
> Erik Kangas, Ph.D. wrote:
> > Has anyone found a way to get the Diffie Hellman TLS v1.2 ciphers (e.=
g..
> > DHE-RSA-AES256-GCM-SHA384) to work with UW IMAP / Panda IMAP?
>
> In order to perform a DH key exchange the server must use a DH group (D=
H
> parameters) and generate a DH key.
>
> UW IMAP neither generate DH parameters on the fly nor supply the
> parameters - thus no DHE can be negotiated.
>
> You may patch the code and use SSL_CTX_set_options(3) to set
> SSL_OP_SINGLE_DH_USE option, but generating DH parameters on the fly is=

> extremely time consuming.
>
>
> Dan
>
>
> _______________________________________________
> Imap-uw mailing list
> [email protected]
> http://mailman13.u.washington.edu/mailman/listinfo/imap-uw



--------------A0B749627E51F09187D53E86
Content-Type: text/html; charset=windows-1252
Content-Transfer-Encoding: quoted-printable

<html>
  <head>
    <meta content=3D"text/html; charset=3Dwindows-1252"
      http-equiv=3D"Content-Type">
  </head>
  <body bgcolor=3D"#FFFFFF" text=3D"#000000">
    <div class=3D"moz-cite-prefix">I have already applied the "ssl cipher=

      and protocol options patch" from
      <a class=3D"moz-txt-link-freetext" href=3D"http://www.freebsd.cz/~d=
an/patch-DAN-SETSSLCIPHER">http://www.freebsd.cz/~dan/patch-DAN-SETSSLCIP=
HER</a> to my panda fork
      at github.com/nkhorman/panda-imap/tree/ssloptions, and submitted a
      pull-request to jonabbey/panda-imap a year ago, that is still
      open.<br>
      <br>
      You may find it useful.<br>
      <br>
      Regards<br>
      Neal Horman<br>
      <br>
      On 4/5/17 5:23 PM, Erik Kangas, Ph.D. wrote:<br>
    </div>
    <blockquote cite=3D"mid:[email protected]"=

      type=3D"cite">
      <meta http-equiv=3D"content-type" content=3D"text/html;
        charset=3Dwindows-1252">
      <div>
        <div>Thanks.<br>
          <br>
          We already pre-generate the DH parameters for sendmail and
          have them sitting around in a dhparms.pem file unique to the
          server. =A0I wonder if anyone has created a patch that allows U=
W
          IMAP to read such a file and supply the parameters?<br>
          <br>
          -Erik Kangas</div>
      </div>
      =A0
      <div style=3D"padding:3px 0 3px 0;border-top:1px solid #DDD;
        border-bottom: 1px solid #DDD;margin:3px 0 3px 0">On April 5,
        2017 06:07:15 pm EDT, "Dan Lukes" <a class=3D"moz-txt-link-rfc239=
6E" href=3D"mailto:[email protected]">&lt;[email protected]&gt;</a> wrote:</div>
      <br>
      <br>
      Erik Kangas, Ph.D. wrote:<br>
      &gt; Has anyone found a way to get the Diffie Hellman TLS v1.2
      ciphers (e.g..<br>
      &gt; DHE-RSA-AES256-GCM-SHA384) to work with UW IMAP / Panda IMAP?<=
br>
      <br>
      In order to perform a DH key exchange the server must use a DH
      group (DH<br>
      parameters) and generate a DH key.<br>
      <br>
      UW IMAP neither generate DH parameters on the fly nor supply the<br=
>
      parameters - thus no DHE can be negotiated.<br>
      <br>
      You may patch the code and use SSL_CTX_set_options(3) to set<br>
      SSL_OP_SINGLE_DH_USE option, but generating DH parameters on the
      fly is<br>
      extremely time consuming.<br>
      <br>
      <br>
      Dan<br>
      =A0
      <br>
      <fieldset class=3D"mimeAttachmentHeader"></fieldset>
      <br>
      <pre wrap=3D"">_______________________________________________
Imap-uw mailing list
<a class=3D"moz-txt-link-abbreviated" href=3D"mailto:[email protected]=
=2Eedu">[email protected]</a>
<a class=3D"moz-txt-link-freetext" href=3D"http://mailman13.u.washington.=
edu/mailman/listinfo/imap-uw">http://mailman13.u.washington.edu/mailman/l=
istinfo/imap-uw</a>
</pre>
    </blockquote>
    <p><br>
    </p>
  </body>
</html>

--------------A0B749627E51F09187D53E86--

--------------ms080406050608080103020403
Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature

MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC
CtowggTwMIID2KADAgECAhA8XaOdkBoMZJ/i/3PLtQ0cMA0GCSqGSIb3DQEBCwUAMHUxCzAJ
BgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBD
ZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UEAxMaU3RhcnRDb20gQ2xhc3MgMSBDbGll
bnQgQ0EwHhcNMTYwNDMwMTQzNjA5WhcNMTkwNzMwMTQzNjA5WjA8MRkwFwYDVQQDDBBuZWFs
QHdhbmxpbmsuY29tMR8wHQYJKoZIhvcNAQkBFhBuZWFsQHdhbmxpbmsuY29tMIIBIjANBgkq
hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArEhcsUIgdRkd0jqQWOKXKLwfcZSj/6DnxZRhz6B5
4V1D7x1JC/RulBFYf3x5TUgc30fmDHQ/X0lB+608X6vf0Q4feG2hTnqtPl2H6BbVDcQUWl6C
+6cXvJFZ3g8C6kXfdt188r+J9050w9dRdmHZogcEjASlqk6yIOC5jlm74/6eRuwHuZVpjpg1
8cxzl+rwcV3RjT8aBvP1TDrS27LyZFbTjOl2CUlK37kLLpQok6LWgnHkt8HQPfXxdlh4sE2X
gfFPQYhkrDghUL8ZIRCoFBUckUT86Zjyp8HzyY69eHl+mfaO4dtcl1ic45Dt5Jgh/Ep9BhhY
LU3tDBcfpvwTEwIDAQABo4IBszCCAa8wDgYDVR0PAQH/BAQDAgSwMB0GA1UdJQQWMBQGCCsG
AQUFBwMCBggrBgEFBQcDBDAJBgNVHRMEAjAAMB0GA1UdDgQWBBSKUMTs47GFLABrEYT6Wxe9
5fl6+DAfBgNVHSMEGDAWgBQkgWw5Yb5JD4+3G0YrySi1J0htaDBvBggrBgEFBQcBAQRjMGEw
JAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbTA5BggrBgEFBQcwAoYtaHR0
cDovL2FpYS5zdGFydHNzbC5jb20vY2VydHMvc2NhLmNsaWVudDEuY3J0MDgGA1UdHwQxMC8w
LaAroCmGJ2h0dHA6Ly9jcmwuc3RhcnRzc2wuY29tL3NjYS1jbGllbnQxLmNybDAbBgNVHREE
FDASgRBuZWFsQHdhbmxpbmsuY29tMCMGA1UdEgQcMBqGGGh0dHA6Ly93d3cuc3RhcnRzc2wu
Y29tLzBGBgNVHSAEPzA9MDsGCysGAQQBgbU3AQIFMCwwKgYIKwYBBQUHAgEWHmh0dHA6Ly93
d3cuc3RhcnRzc2wuY29tL3BvbGljeTANBgkqhkiG9w0BAQsFAAOCAQEAlxJ6KHJ1vmbr+rz1
05wPXOwfuMO8YGOm7Wn1vKM4x/DHEm/Lo8yIwjvET2/hvnFcC2HvgmXcnEJBa/vfCepoi9zf
qDtMhzV9zDzLISspTS4p4qkH6LoqkDIyJWNuHucMbb8M6Pk3TtWEoEa+C8DaJNDCBXdSoJsV
Av3ncbauhMbgA4k1mhgqGysS7c3gBEp7+bFh5EDcsTEJEy8mE86H4U3UlYTHBNwylQPxG5JZ
Rvw5rxiqKUtRqWzJTlBh/QzhV4qTbHXcgFh/89YCVDZe4kkL2cp+Wep8EmEXSMlHE87+aD3O
yqkWG15E9aFN9wOOIYKy4BWHwdNujIy64TZSuzCCBeIwggPKoAMCAQICEGunin0K14jWUQr5
WeTntOEwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29t
IEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcxKTAn
BgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTE1MTIxNjAxMDAw
NVoXDTMwMTIxNjAxMDAwNVowdTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0
ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMwIQYDVQQD
ExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
AQoCggEBAL192vfDon2D9luC/dtbX64eG3XAtRmvmCSsu1d52DXsCR58zJQbCtB2/A5uFqNx
WacpXGGtTCRk9dEDBlmixEd8QiLkUfvHpJX/xKnmVkS6Iye8wUbYzMsDzgnpazlPg19dnSqf
hM+Cevdfa89VLnUztRr2cgmCfyO9Otrh7LJDPG+4D8ZnAqDtVB8MKYJL6QgKyVhhaBc4y3bG
WxKyXEtx7QIZZGxPwSkzK3WIN+VKNdkiwTubW5PIdopmykwvIjLPqbJK7yPwFZYekKE015Os
W6FV+s4DIM8UlVS8pkIsoGGJtMuWjLL4tq2hYQuuN0jhrxK1ljz50hH23gA9cbMCAwEAAaOC
AWQwggFgMA4GA1UdDwEB/wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQw
EgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzApMCegJaAjhiFodHRwOi8vY3JsLnN0YXJ0
c3NsLmNvbS9zZnNjYS5jcmwwZgYIKwYBBQUHAQEEWjBYMCQGCCsGAQUFBzABhhhodHRwOi8v
b2NzcC5zdGFydHNzbC5jb20wMAYIKwYBBQUHMAKGJGh0dHA6Ly9haWEuc3RhcnRzc2wuY29t
L2NlcnRzL2NhLmNydDAdBgNVHQ4EFgQUJIFsOWG+SQ+PtxtGK8kotSdIbWgwHwYDVR0jBBgw
FoAUTgvvGqRAW6UXaYcwyjRoQ9BBrvIwPwYDVR0gBDgwNjA0BgRVHSAAMCwwKgYIKwYBBQUH
AgEWHmh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeTANBgkqhkiG9w0BAQsFAAOCAgEA
i+P3h+wBi4StDwECW5zhIycjBL008HACblIf26HY0JdOruKbrWDsXUsiI0j/7Crft9S5oxvP
iDtVqspBOB/y5uzSns1lZwh7sG96bYBZpcGzGxpFNjDmQbcM3yl3WFIRS4WhNrsOY14V7y2I
rUGsvetsD+bjyOngCIVeC/GmsmtbuLOzJ606tEc9uRbhjTu/b0x2Fo+/e7UkQvKzNeo7OMhi
jixaULyINBfCBJb+e29bLafgu6JqjOUJ9eXXj20p6q/CW+uVrZiSW57+q5an2P2i7hP85jQJ
cy5j4HzA0rSiF3YPhKGAWUxKPMAVGgcYoXzWydOvZ3UDsTDTagXpRDIKQLZo02wrlxY6iMFq
vlzsemVf1odhQJmi7Eh5TbxI40kDGcBOBHhwnaOumZhLP+SWJQnjpLpSlUOj95uf1zo9oz9e
0NgIJoz/tdfrBzez76xtDsK0KfUDHt1/q59BvDI7RX6gVr0fQoCyMczNzCTcRXYHY0tq2J0o
T+bsb6sH2b4WVWAiJKnSYaWDjdA70qHX4mq9MIjO/ZskmSY8wtAk24orAc0vwXgYanqNsBX5
Yv4sN4Z9VyrwMdLcusP7HJgRdAGKpkR2I9U4zEsNJQJewM7S4Jalo1DyPrLpL2nTET8ZrSl5
Utp1UeGp/2deoprGevfnxWB+vHNQiu85o6MxggPMMIIDyAIBATCBiTB1MQswCQYDVQQGEwJJ
TDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEpMCcGA1UECxMgU3RhcnRDb20gQ2VydGlmaWNh
dGlvbiBBdXRob3JpdHkxIzAhBgNVBAMTGlN0YXJ0Q29tIENsYXNzIDEgQ2xpZW50IENBAhA8
XaOdkBoMZJ/i/3PLtQ0cMA0GCWCGSAFlAwQCAQUAoIICEzAYBgkqhkiG9w0BCQMxCwYJKoZI
hvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xNzA0MDUyMjQyMDZaMC8GCSqGSIb3DQEJBDEiBCCE
lBQZKlbOziHfDvjIKpJ1h+cMknBcEU93to8eHTgcjTBsBgkqhkiG9w0BCQ8xXzBdMAsGCWCG
SAFlAwQBKjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqG
SIb3DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMCAgEoMIGaBgkrBgEEAYI3EAQxgYwwgYkw
dTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0
Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENvbSBDbGFzcyAx
IENsaWVudCBDQQIQPF2jnZAaDGSf4v9zy7UNHDCBnAYLKoZIhvcNAQkQAgsxgYyggYkwdTEL
MAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29t
IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENvbSBDbGFzcyAxIENs
aWVudCBDQQIQPF2jnZAaDGSf4v9zy7UNHDANBgkqhkiG9w0BAQEFAASCAQCeH0H8Le4jaA6W
t28LjZa+3JzSSSg9OKn5EvnmNE7xAlC+5lJvYkxNv7vCzWn1TnkMM1XrB2FVAjH81QNbEDO3
bZ6EiuPCEV9vOXRTMNQsZJQgA4LFtoV29LrPzwcy0UeDXMQMqqstxzXEB8UIzmTm7PFKRKCU
fycxNahwAm4ZzfzVgolzQ+v1ZdwAz5f7zm1G9jW5phkxtUZPrtMowLPGOyFu4tV3yS79iqDu
NT9puL4XVftUoWBgyLSWJ0zvUCq7DVxweN4bpcTFIq7Sh0jbtUf2zmRrJ/38gjaDbOUhor9B
rbEkBdbRF50BeUy41mHexurlvMUkDkjUgtwkdNpwAAAAAAAA
--------------ms080406050608080103020403--

--===============0259745614517068020==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Imap-uw mailing list
[email protected]
http://mailman13.u.washington.edu/mailman/listinfo/imap-uw

--===============0259745614517068020==--