From 5ddcb614a0a96a54ed1a7aa3cba3356b85021096 Mon Sep 17 00:00:00 2001 From: Ingela Anderton Andin Date: Fri, 15 Mar 2013 10:20:09 +0100 Subject: ssl: Add option to list all available ciper suites and enhanced documentation --- lib/ssl/doc/src/ssl.xml | 56 +++++++++++++++++++++++++------------------------ lib/ssl/src/ssl.erl | 11 ++++++++-- 2 files changed, 38 insertions(+), 29 deletions(-) (limited to 'lib/ssl') diff --git a/lib/ssl/doc/src/ssl.xml b/lib/ssl/doc/src/ssl.xml index d78deb3252..2501db858a 100644 --- a/lib/ssl/doc/src/ssl.xml +++ b/lib/ssl/doc/src/ssl.xml @@ -184,13 +184,16 @@ {ciphers, ciphers()} The cipher suites that should be supported. The function - cipher_suites/0 can be used to find all available - ciphers. Additionally some anonymous cipher suites ({dh_anon, - rc4_128, md5}, {dh_anon, des_cbc, sha}, {dh_anon, - '3des_ede_cbc', sha}, {dh_anon, aes_128_cbc, sha}, {dh_anon, - aes_256_cbc, sha}) are supported for testing purposes and will - only work if explicitly enabled by this option and they are supported/enabled - by the peer also. + cipher_suites/0 can be used to find all ciphers that are + supported by default. cipher_suites(all) may be called + to find all available cipher suites. + Pre-Shared Key (RFC 4279 and + RFC 5487), + Secure Remote Password (RFC 5054) + and anonymous cipher suites only work if explicitly enabled by + this option and they are supported/enabled by the peer also. + Note that anonymous cipher suites are supported for testing purposes + only and should not be used when security matters. {ssl_imp, new | old} @@ -200,10 +203,10 @@ {secure_renegotiate, boolean()} Specifies if to reject renegotiation attempt that does - not live up to RFC 5746. By default secure_renegotiate is + not live up to RFC 5746. By default secure_renegotiate is set to false i.e. secure renegotiation will be used if possible but it will fallback to unsecure renegotiation if the peer - does not support RFC 5746. + does not support RFC 5746. {depth, integer()} @@ -305,25 +308,22 @@ fun(OtpCert :: #'OTPCertificate'{}, Event :: {bad_cert, Reason :: atom()} | fun(psk, PSKIdentity, UserState :: term()) -> {ok, SharedSecret :: binary()} | error; fun(srp, Username, UserState :: term()) -> - {ok, {SRPParams :: srp_param_type(), Salt :: binary(), UserPassHash :: binary()}} | error. + {ok, {SRPParams :: srp_param_type(), Salt :: binary(), DerivedKey :: binary()}} | error. -

For PSK cipher suites, the lookup fun will be called in the client and server the find - the shared secret. On the client, PSKIdentity will be set to hint presented by the server - or undefined. On the server, PSKIdentity is the identity presented by the client. - For SRP cipher suites, the fun will only be used by the server to find the SRP values. +

For Pre-Shared Key (PSK) cipher suites, the lookup fun will + be called by the client and server to determine the shared + secret. When called by the client, PSKIdentity will be set to the + hint presented by the server or undefined. When called by the + server, PSKIdentity is the identity presented by the client.

-

For SRP, the required values on a server will usually be precalculated and kept in a passwd - like file. A sample SRP lookup fun that calculates the values on the fly for a single user entry - with a static password could be:

- - Salt = ssl:random_bytes(16), - UserPassHash = crypto:sha([Salt, crypto:sha([Username, <<$:>>, <<"secret">>])]), - {ok, {srp_1024, Salt, UserPassHash}}. - ]]> - +

For Secure Remote Password (SRP), the fun will only be used by the server to obtain + parameters that it will use to generate its session keys. DerivedKey should be + derived according to RFC 2945 and + RFC 5054: + crypto:sha([Salt, crypto:sha([Username, <<$:>>, Password])]) +

@@ -473,13 +473,16 @@ user_lookup(srp, Username, _UserState) -> cipher_suites(Type) -> ciphers() Returns a list of supported cipher suites - Type = erlang | openssl + Type = erlang | openssl | all

Returns a list of supported cipher suites. cipher_suites() is equivalent to cipher_suites(erlang). Type openssl is provided for backwards compatibility with - old ssl that used openssl. + old ssl that used openssl. cipher_suites(all) returns + all available cipher suites. The cipher suites not present + in cipher_suites(erlang) but in included in cipher_suites(all) + will not be used unless explicitly configured by the user.

@@ -867,7 +870,6 @@ user_lookup(srp, Username, _UserState) -> -
diff --git a/lib/ssl/src/ssl.erl b/lib/ssl/src/ssl.erl index d5f5fa6b04..70f3b4f050 100644 --- a/lib/ssl/src/ssl.erl +++ b/lib/ssl/src/ssl.erl @@ -355,7 +355,7 @@ negotiated_next_protocol(#sslsocket{pid = Pid}) -> ssl_connection:negotiated_next_protocol(Pid). -spec cipher_suites() -> [erl_cipher_suite()]. --spec cipher_suites(erlang | openssl) -> [erl_cipher_suite()] | [string()]. +-spec cipher_suites(erlang | openssl | all ) -> [erl_cipher_suite()] | [string()]. %% Description: Returns all supported cipher suites. %%-------------------------------------------------------------------- @@ -368,8 +368,15 @@ cipher_suites(erlang) -> cipher_suites(openssl) -> Version = ssl_record:highest_protocol_version([]), - [ssl_cipher:openssl_suite_name(S) || S <- ssl_cipher:suites(Version)]. + [ssl_cipher:openssl_suite_name(S) || S <- ssl_cipher:suites(Version)]; +cipher_suites(all) -> + Version = ssl_record:highest_protocol_version([]), + Supported = ssl_cipher:suites(Version) + ++ ssl_cipher:anonymous_suites() + ++ ssl_cipher:psk_suites(Version) + ++ ssl_cipher:srp_suites(), + [suite_definition(S) || S <- Supported]. %%-------------------------------------------------------------------- -spec getopts(#sslsocket{}, [gen_tcp:option_name()]) -> {ok, [gen_tcp:option()]} | {error, reason()}. -- cgit v1.2.3