Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-20666

QSslSocket: Diffie-Hellman key exchange is not supported (ciphers using DH)

    XMLWordPrintable

Details

    • Bug
    • Resolution: Done
    • P3: Somewhat important
    • 5.3.0 RC1
    • 4.7.3
    • Network: SSL
    • None
    • a95dbcd8f5b5e62541fc99f0eb256a853fd6e5b6

    Description

      I have had a problem by using special ciphers in combination with QSslSocket.
      So I wrote a test tool, that creates an server that supports all ciphers returned by the static function QSslSocket::supportedCiphers() and for each cipher a client, that try to connect to the server with only one cipher supported.
      I use only type RSA for the certificate, so the handshake failure for DSA types is okay [1].
      The result shows, that ALL ciphers that use Diffie-Hellman key exchange also fails.
      So, I do a little debugging, read the OpenSSL documentation and wrote a test tool that uses OpenSSL directly.

      The result:
      To support DH key exchange we have to setup parameters or a callback. See [2].

      I patched (just for testing) the QSslSocket code to register a callback that returned the necessary DH object.
      The DH ciphers for RSA are now working.

      The better approach (IMHO) would be, if a callback function will be registered, that call a protected function of the QSslSocket, that raises a SslError that now diffie-hallmen parameters are set.
      So if some would like to support DH, he can subclass QSslSocket and overwrite that function.
      Another way could be to use the signal/slot mechanism, but in that case only direct connections would be successful (IMHO).

      [1]
      The internal certificate store of OpenSSL can hold two private key/certificate pairs at a time:
      one key/certificate of type RSA and
      one key/certificate of type DSA.
      The certificate used depends on the cipher select.

      [2]
      http://www.openssl.org/docs/ssl/SSL_CTX_set_tmp_dh_callback.html

      Attachments

        Issue Links

          For Gerrit Dashboard: QTBUG-20666
          # Subject Branch Project Status CR V

          Activity

            People

              Unassigned Unassigned
              maggu2810 Markus Rathgeb
              Votes:
              1 Vote for this issue
              Watchers:
              7 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Gerrit Reviews

                  There are no open Gerrit changes