Re: Patch for TLS 1.2 DHE* cipher support in uwimap/panda?
"Erik Kangas, Ph.D." <[email protected]> Thu, 06 Apr 2017 19:01:20 +0000
| Newsgroups | gmane.mail.imap.uw.c-client |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. If you cannot view the attachment(s), then your email client does not support MIME. --------------------_Boundary_53427770.608199 Content-Type: multipart/alternative; boundary="-------------6392368.5248856" ---------------6392368.5248856 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: quoted-printable This sounds great! Once this and the DH Params patches are in place, we will install on a=20 few servers and see how they go and let everyone know before we roll=20 out everywhere. If anyone else has any particular useful patches they have made, maybe=20 this is a good time to speak up and perhaps add them to the code base. Good job, guys. -Erik On April 6, 2017 02:58:37 pm EDT, "Neal Horman" <[email protected]> wrote: I have applied the differences to Dan's patch and pushed them to=20 github.com/nkhorman/panda-imap/tree/ssloptions. I've only compile tested this on FreeBSD 10.3 I'll also apply a DH patch, if someone wants provide it. Also, I'm open to other patches that would be generally useful for everyone. If everyone agrees, I'll merge the ssloptions branch to master. Regards Neal On 4/5/17 5:23 PM, Erik Kangas, Ph.D. wrote: Thanks. We already pre-generate the DH parameters for sendmail and have them=20 sitting around in a dhparms.pem file unique to the server. I wonder if=20 anyone has created a patch that allows UW IMAP to read such a file and=20 supply the parameters? -Erik Kangas On April 5, 2017 06:07:15 pm EDT, "Dan Lukes" [1]<[email protected]> wrote: Erik Kangas, Ph.D. wrote: > Has anyone found a way to get the Diffie Hellman TLS v1.2 ciphers (e.g= .. > DHE-RSA-AES256-GCM-SHA384) to work with UW IMAP / Panda IMAP? In order to perform a DH key exchange the server must use a DH group (DH parameters) and generate a DH key. UW IMAP neither generate DH parameters on the fly nor supply the parameters - thus no DHE can be negotiated. You may patch the code and use SSL_CTX_set_options(3) to set SSL_OP_SINGLE_DH_USE option, but generating DH parameters on the fly is extremely time consuming. Dan _______________________________________________ Imap-uw mailing list [2][email protected] [3]http://mailman13.u.washington.edu/mailman/listinfo/imap-uw ---------------------------------------------------------------------------= ---------------------------------------------------------------------------= ---------------------------------------------------------------------------= ---------------------------------------------------------------------------= ---------------------------------------------------------------------------= ---------------------------------------------------------------------------= ---------------------------------------------------------------------------= ---------------------------------------------------------------------------= ---------------------------------------------------------------------------= ---------------------------------------------------------------------------= ---------------------------------------------------------------------------= ---------------------------------------------------------------------------= ---------------------------------------------------------------------------= ------------------ _______________________________________________ Imap-uw mailing list [email protected] [4]http://mailman13.u.washington.edu/mailman/listinfo/imap-uw References Visible links 1. mailto:[email protected] 2. mailto:[email protected] 3. http://mailman13.u.washington.edu/mailman/listinfo/imap-uw 4. http://mailman13.u.washington.edu/mailman/listinfo/imap-uw ---------------6392368.5248856 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML> <HTML> <HEAD><meta http-equiv=3D"content-type" content=3D"text/html; charset=3DUTF= -8"></HEAD> <BODY style=3D"padding:5px; line-height: 1.3em; font-size: 14px; color: #33= 3; background-color: #FFF; font-family: Arial, Helvetica, sans-serif"> <div>This sounds great!<br /> <br /> Once this and the DH Params patches are in place, we will install on a= few servers and see how they go and let everyone know before we roll out e= verywhere.<br /> <br /> If anyone else has any particular useful patches they have made, maybe this= is a good time to speak up and perhaps add them to the code base.<br /> <br /> Good job, guys.<br /> -Erik<br /> </div> <br /> <div style=3D"padding:3px 0 3px 0;border-top:1px solid #DDD; border-bottom:= 1px solid #DDD;margin:3px 0 3px 0">On April 6, 2017 02:58:37 pm EDT, "= ;Neal Horman" <[email protected]> wrote:</div> <div class=3D"moz-cite-prefix">I have applied the differences to Dan's = patch and pushed them to github.com/nkhorman/panda-imap/tree/ssloptions.<br= /> I've only compile tested this on FreeBSD 10.3<br /> <br /> I'll also apply a DH patch, if someone wants provide it.<br /> Also, I'm open to other patches that would be generally useful for ever= yone.<br /> <br /> If everyone agrees, I'll merge the ssloptions branch to master.<br /> <br /> Regards<br /> Neal<br /> <br /> <br /> On 4/5/17 5:23 PM, Erik Kangas, Ph.D. wrote:</div> <blockquote cite=3D"mid:[email protected]" type= =3D"cite"> <div> <div>Thanks.<br /> <br /> We already pre-generate the DH parameters for sendmail and have them sittin= g around in a dhparms.pem file unique to the server. I wonder if anyo= ne has created a patch that allows UW IMAP to read such a file and supply t= he parameters?<br /> <br /> -Erik Kangas</div> </div> <div style=3D"padding:3px 0 3px 0;border-top:1px solid #DDD; border-bottom: 1px solid #DDD;margin:3px 0 3px 0">On April 5, 2017 = 06:07:15 pm EDT, "Dan Lukes" <a class=3D"moz-txt-link-rfc2396E" h= ref=3D"mailto:[email protected]"><[email protected]></a> wrote:</div> <br /> <br /> Erik Kangas, Ph.D. wrote:<br /> > Has anyone found a way to get the Diffie Hellman TLS v1.2 ciphers (e.g= ..<br /> > DHE-RSA-AES256-GCM-SHA384) to work with UW IMAP / Panda IMAP?<br /> <br /> In order to perform a DH key exchange the server must use a DH group (DH<br= /> parameters) and generate a DH key.<br /> <br /> UW IMAP neither generate DH parameters on the fly nor supply the<br /> parameters - thus no DHE can be negotiated.<br /> <br /> You may patch the code and use SSL_CTX_set_options(3) to set<br /> SSL_OP_SINGLE_DH_USE option, but generating DH parameters on the fly is<br = /> extremely time consuming.<br /> <br /> <br /> Dan<br /> <fieldset class=3D"mimeAttachmentHeader"> </fieldset> <pre wrap=3D""> _______________________________________________ Imap-uw mailing list <a class=3D"moz-txt-link-abbreviated" href=3D"mailto:[email protected]= du">[email protected]</a> <a class=3D"moz-txt-link-freetext" href=3D"http://mailman13.u.washington.ed= u/mailman/listinfo/imap-uw">http://mailman13.u.washington.edu/mailman/listi= nfo/imap-uw</a> </pre> </blockquote> <p> </p> <hr />_______________________________________________<br /> Imap-uw mailing list<br /> [email protected]<br /> <a class=3D"monobody" href=3D"http://mailman13.u.washington.edu/mailman/lis= tinfo/imap-uw" target=3D"_blank">http://mailman13.u.washington.edu/mailman/= listinfo/imap-uw</a> </BODY> </HTML> ---------------6392368.5248856-- --------------------_Boundary_53427770.608199 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Imap-uw mailing list [email protected] http://mailman13.u.washington.edu/mailman/listinfo/imap-uw --------------------_Boundary_53427770.608199--