{"action":"created","issue":{"url":"https://api.github.com/repos/drwetter/testssl.sh/issues/207","labels_url":"https://api.github.com/repos/drwetter/testssl.sh/issues/207/labels{/name}","comments_url":"https://api.github.com/repos/drwetter/testssl.sh/issues/207/comments","events_url":"https://api.github.com/repos/drwetter/testssl.sh/issues/207/events","html_url":"https://github.com/drwetter/testssl.sh/pull/207","id":109062885,"number":207,"title":"Fix CBC cipher selection for BEAST detection","user":{"login":"typingArtist","id":260607,"avatar_url":"https://avatars.githubusercontent.com/u/260607?v=3","gravatar_id":"","url":"https://api.github.com/users/typingArtist","html_url":"https://github.com/typingArtist","followers_url":"https://api.github.com/users/typingArtist/followers","following_url":"https://api.github.com/users/typingArtist/following{/other_user}","gists_url":"https://api.github.com/users/typingArtist/gists{/gist_id}","starred_url":"https://api.github.com/users/typingArtist/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/typingArtist/subscriptions","organizations_url":"https://api.github.com/users/typingArtist/orgs","repos_url":"https://api.github.com/users/typingArtist/repos","events_url":"https://api.github.com/users/typingArtist/events{/privacy}","received_events_url":"https://api.github.com/users/typingArtist/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-09-30T10:56:17Z","updated_at":"2015-09-30T12:58:34Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/drwetter/testssl.sh/pulls/207","html_url":"https://github.com/drwetter/testssl.sh/pull/207","diff_url":"https://github.com/drwetter/testssl.sh/pull/207.diff","patch_url":"https://github.com/drwetter/testssl.sh/pull/207.patch"},"body":"(redoing https://github.com/drwetter/testssl.sh/pull/205)\r\n\r\nMy server runs ECDHE-ECDSA ciphers only, and as documented by SSL Labs, it’s vulnerable to BEAST as it supports TLS 1.0 and Cipher 0xc00a (TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA). However, testssl.sh doesn’t detect this situation as it’s never choosing the affected CBC cipher. Not all CBC ciphers have CBC in their **openssl** name. Their RFC counterpart **does** have CBC in its name, but openssl doesn’t help us find the proper set of ciphers.\r\nSince the list of CBC ciphers isn’t going to grow in the future, I think it’s safe to hard-code the list. Nevertheless, I supplied a small script to extract the CBC cipher list from the ciphers given in openssl-rfc.mapping.html, based on their RFC name.\r\n\r\nThis is from the Qualys SSLLabs report of my server:\r\n\r\n```\r\nProtocols\r\nTLS 1.2 Yes\r\nTLS 1.1 Yes\r\nTLS 1.0 Yes\r\nSSL 3 No\r\nSSL 2 No\r\n\r\nCipher Suites (SSL 3+ suites in server-preferred order; deprecated and SSL 2 suites at the end)\r\nTLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (0xcc14) ECDH 384 bits (eq. 7680 bits RSA) FS 256\r\nTLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (0xc02c) ECDH 384 bits (eq. 7680 bits RSA) FS 256\r\nTLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b) ECDH 384 bits (eq. 7680 bits RSA) FS 128\r\nTLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 (0xc024) ECDH 384 bits (eq. 7680 bits RSA) FS 256\r\nTLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a) ECDH 384 bits (eq. 7680 bits RSA) FS 256\r\n```\r\n\r\nThe last one is actually the one used in TLS 1.0 connections and is not tried by the old version of testssl.sh as its openssl name is ECDHE-ECDSA-AES256-SHA (no CBC in the name).\r\n\r\n```\r\nBEAST attack \tNot mitigated server-side (more info)   TLS 1.0: 0xc00a\r\n```\r\n\r\nThe following is a cutout of the output of `testssl.sh --wide` on my server *without* the patch applied:\r\n\r\n```\r\n--> Testing for BEAST vulnerability\r\n\r\n BEAST (CVE-2011-3389)\r\n\r\n TLS1:\r\nHexcode  Cipher Suite Name (OpenSSL)    KeyExch.   Encryption Bits        Cipher Suite Name (RFC)\r\n-----------------------------------------------------------------------------------------------------------------------\r\n no CBC ciphers for TLS1 (OK)\r\n```\r\n\r\nNow again *with* the patch:\r\n\r\n```\r\n--> Testing for BEAST vulnerability\r\n\r\n BEAST (CVE-2011-3389)\r\n\r\n TLS1:\r\nHexcode  Cipher Suite Name (OpenSSL)    KeyExch.   Encryption Bits        Cipher Suite Name (RFC)\r\n-----------------------------------------------------------------------------------------------------------------------\r\n xc00a   ECDHE-ECDSA-AES256-SHA         ECDH       AES        256         TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA\r\n\r\nVULNERABLE -- but also supports higher protocols (possible mitigation): TLSv1.1 TLSv1.2\r\n```\r\n\r\nPlease pull."},"comment":{"url":"https://api.github.com/repos/drwetter/testssl.sh/issues/comments/144388305","html_url":"https://github.com/drwetter/testssl.sh/pull/207#issuecomment-144388305","issue_url":"https://api.github.com/repos/drwetter/testssl.sh/issues/207","id":144388305,"user":{"login":"typingArtist","id":260607,"avatar_url":"https://avatars.githubusercontent.com/u/260607?v=3","gravatar_id":"","url":"https://api.github.com/users/typingArtist","html_url":"https://github.com/typingArtist","followers_url":"https://api.github.com/users/typingArtist/followers","following_url":"https://api.github.com/users/typingArtist/following{/other_user}","gists_url":"https://api.github.com/users/typingArtist/gists{/gist_id}","starred_url":"https://api.github.com/users/typingArtist/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/typingArtist/subscriptions","organizations_url":"https://api.github.com/users/typingArtist/orgs","repos_url":"https://api.github.com/users/typingArtist/repos","events_url":"https://api.github.com/users/typingArtist/events{/privacy}","received_events_url":"https://api.github.com/users/typingArtist/received_events","type":"User","site_admin":false},"created_at":"2015-09-30T12:58:34Z","updated_at":"2015-09-30T12:58:34Z","body":"I don’t think we have to cherry-pick the list for only those supported in ≤TLS1.0 – higher CBCs shouldn’t work in SSLv3 and TLS1.0 anyway – it’s just a matter of performance. The length limitation, you mentioned, of 128 ciphers is now obsolete anyway as openssl is not used for cipher list generation anymore."}}