[users@httpd] TLSv1.3, AES and Apache2 on opensuse leap 15.2

[cryptearth <cr...@cryptearth.de>]

first of: as I'm not sure what's causing this issue I'll post this 
question on these locations:
opensuse official forums 
https://forums.opensuse.org/showthread.php/541909-TLSv1-3-AES-and-Apache2
apache httpd mailing list
openssl mailing list

As OpenSuSE 15.2 recently released with openssl 1.1.1 in its repos it's 
now possible to use TLSv1.3 with Apache2 out of the box. As I use the 
TLS test on ssllabs.com as a reference I encountered some issues I'd 
like to ask for help to fix.
First of, as most important, the used versions:

apache2: 2.4.43-lp152.1.1
openssl: 1.1.1d-lp152.1.1

And here's the config (only used ssl-global.conf for this test):

SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLCipherSuite 
TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:ECDHE-RSA-CHACHA20-POLY1305HE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES256-GCM-SHA384HE-RSA-AES256-GCM-SHA384
SSLOpenSSLConfCmd Curves secp521r1:secp384r1

There were no other changes made to any other conf.
As one can see I only enabled AES with 256 bit keylength and ordered 
chacha20 preferred over AES. But when testing with ssllabs.com server 
test it shows two issues I'm unable to solve myself:

1) although not enabled the server test also shows AES with only 128 bit 
keylength enabled and working - hence capping the score to only 90% for 
cipher strength (only ciphers with an equivalent of at least RSA 4096 
give one full 100%)
2) the order doesn'T match the config - it shows AES256 as the most 
preferred one, then followed by the chacha20 and finally the AES128

As I don't know if this is an issue with apache, openssl or opensuse I 
posted it on all three to reach most group of people, so, if you're 
member of more than one of the mentioned I apologize if you get this 
topic multiple times.

Thanks in advance to anyone,

Matt

Re: [users@httpd] TLSv1.3, AES and Apache2 on opensuse leap 15.2

[cryptearth <cr...@cryptearth.de>]

I'd just like to inform anyone that this topic was solved by replies on 
both the opensuse forums as well as on the openssl mailing list. The 
trick was to split up the SSLCipherSuites directive:

SSLCipherSuite TLSv1.3 TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384
SSLCipherSuite SSL 
ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384

This now results in the ssllabs.com server test only shows the chacha20 
and AES256 cipher suites for 1.3 in that order.

As the reply on the opensuse forums noted: As 1.3 requires AES128 
(without mention them by name - my guess is this was just another of 
those "recommendations" by one of those north-american 
three-letter-clubs) the ssllabs.com test had a penalty in place at first 
which caped the final score when the server did not offer the mandatory 
AES128. But as users reported it as an issue on their githubs it was 
decided to lift this penalty as otherwise both, a correct configured 
server as well as a "more secure one", would never be able to get all 
four tests with 100%. Reasons: I don'T know, couldn't find any 
explanation why - only that it was lifted so servers not supporting 
AES128 don't get a penalty anymore, although this means it doesn't 
follow the RFC exactly anymore.

This topic is solved for now.

Matt

Am 21.07.2020 um 04:20 schrieb cryptearth:
> first of: as I'm not sure what's causing this issue I'll post this 
> question on these locations:
> opensuse official forums 
> https://forums.opensuse.org/showthread.php/541909-TLSv1-3-AES-and-Apache2
> apache httpd mailing list
> openssl mailing list
>
> As OpenSuSE 15.2 recently released with openssl 1.1.1 in its repos 
> it's now possible to use TLSv1.3 with Apache2 out of the box. As I use 
> the TLS test on ssllabs.com as a reference I encountered some issues 
> I'd like to ask for help to fix.
> First of, as most important, the used versions:
>
> apache2: 2.4.43-lp152.1.1
> openssl: 1.1.1d-lp152.1.1
>
> And here's the config (only used ssl-global.conf for this test):
>
> SSLProtocol -all +TLSv1.2 +TLSv1.3
> SSLCipherSuite 
> TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384
> SSLOpenSSLConfCmd Curves secp521r1:secp384r1
>
> There were no other changes made to any other conf.
> As one can see I only enabled AES with 256 bit keylength and ordered 
> chacha20 preferred over AES. But when testing with ssllabs.com server 
> test it shows two issues I'm unable to solve myself:
>
> 1) although not enabled the server test also shows AES with only 128 
> bit keylength enabled and working - hence capping the score to only 
> 90% for cipher strength (only ciphers with an equivalent of at least 
> RSA 4096 give one full 100%)
> 2) the order doesn'T match the config - it shows AES256 as the most 
> preferred one, then followed by the chacha20 and finally the AES128
>
> As I don't know if this is an issue with apache, openssl or opensuse I 
> posted it on all three to reach most group of people, so, if you're 
> member of more than one of the mentioned I apologize if you get this 
> topic multiple times.
>
> Thanks in advance to anyone,
>
> Matt