Details
-
Bug
-
Resolution: Done
-
P3: Somewhat important
-
4.7.3
-
None
-
a95dbcd8f5b5e62541fc99f0eb256a853fd6e5b6
Description
I have had a problem by using special ciphers in combination with QSslSocket.
So I wrote a test tool, that creates an server that supports all ciphers returned by the static function QSslSocket::supportedCiphers() and for each cipher a client, that try to connect to the server with only one cipher supported.
I use only type RSA for the certificate, so the handshake failure for DSA types is okay [1].
The result shows, that ALL ciphers that use Diffie-Hellman key exchange also fails.
So, I do a little debugging, read the OpenSSL documentation and wrote a test tool that uses OpenSSL directly.
The result:
To support DH key exchange we have to setup parameters or a callback. See [2].
I patched (just for testing) the QSslSocket code to register a callback that returned the necessary DH object.
The DH ciphers for RSA are now working.
The better approach (IMHO) would be, if a callback function will be registered, that call a protected function of the QSslSocket, that raises a SslError that now diffie-hallmen parameters are set.
So if some would like to support DH, he can subclass QSslSocket and overwrite that function.
Another way could be to use the signal/slot mechanism, but in that case only direct connections would be successful (IMHO).
[1]
The internal certificate store of OpenSSL can hold two private key/certificate pairs at a time:
one key/certificate of type RSA and
one key/certificate of type DSA.
The certificate used depends on the cipher select.
[2]
http://www.openssl.org/docs/ssl/SSL_CTX_set_tmp_dh_callback.html
Attachments
Issue Links
- is required for
-
QTBUG-36272 SSL: add public API to choose only ciphers supporting (Perfect) Forward Secrecy
- Reported
- relates to
-
QTBUG-18972 Add Elliptic Curve support to QSsl
- Closed
For Gerrit Dashboard: QTBUG-20666 | ||||||
---|---|---|---|---|---|---|
# | Subject | Branch | Project | Status | CR | V |
82810,4 | Support for DH and ECDH key exchange for QSslSocket servers | dev | qt/qtbase | Status: ABANDONED | 0 | 0 |
82817,2 | Support for DH and ECDH key exchange for QSslSocket servers | stable | qt/qtbase | Status: MERGED | +2 | 0 |