{"action":"created","issue":{"url":"https://api.github.com/repos/drwetter/testssl.sh/issues/413","repository_url":"https://api.github.com/repos/drwetter/testssl.sh","labels_url":"https://api.github.com/repos/drwetter/testssl.sh/issues/413/labels{/name}","comments_url":"https://api.github.com/repos/drwetter/testssl.sh/issues/413/comments","events_url":"https://api.github.com/repos/drwetter/testssl.sh/issues/413/events","html_url":"https://github.com/drwetter/testssl.sh/pull/413","id":164863532,"number":413,"title":"Determine support elliptic curves for ECDHE- ciphers","user":{"login":"dcooper16","id":16493199,"avatar_url":"https://avatars.githubusercontent.com/u/16493199?v=3","gravatar_id":"","url":"https://api.github.com/users/dcooper16","html_url":"https://github.com/dcooper16","followers_url":"https://api.github.com/users/dcooper16/followers","following_url":"https://api.github.com/users/dcooper16/following{/other_user}","gists_url":"https://api.github.com/users/dcooper16/gists{/gist_id}","starred_url":"https://api.github.com/users/dcooper16/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dcooper16/subscriptions","organizations_url":"https://api.github.com/users/dcooper16/orgs","repos_url":"https://api.github.com/users/dcooper16/repos","events_url":"https://api.github.com/users/dcooper16/events{/privacy}","received_events_url":"https://api.github.com/users/dcooper16/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-07-11T15:20:09Z","updated_at":"2016-07-11T16:11:38Z","closed_at":"2016-07-11T16:11:10Z","pull_request":{"url":"https://api.github.com/repos/drwetter/testssl.sh/pulls/413","html_url":"https://github.com/drwetter/testssl.sh/pull/413","diff_url":"https://github.com/drwetter/testssl.sh/pull/413.diff","patch_url":"https://github.com/drwetter/testssl.sh/pull/413.patch"},"body":"As was discussed in #122, the PR displays the set of elliptic curves supported by the server for use with ECDHE-* ciphers. Since the ECDHE-* ciphers are PFS ciphers, I added the new code to run_pfs().\r\n\r\nNot all versions of OpenSSL support the \"-curves\" option for \"s_client\". At the moment, if no curves are found, then the code just doesn't display anything.\r\n\r\nIt was my original intention to implement the check for supported curves in sockets as well, but I ran into a problem. I originally wrote the sockets version to try to connect to the server with only ECDHE-* ciphers specified and with the Supported Elliptic Curves extension only specifying one curve. If the connection was successful, then I assumed the specified curve was supported. This worked in most cases, however, it appears that some servers (e.g., www.healthcare.gov) ignore the Supported Elliptic Curves extension and so the connection will succeed even if the curve the server uses isn't included in the Supported Elliptic Curves extension.\r\n\r\nThe solution is to compare the curve used by the server to the one specified in the Supported Elliptic Curves extension. However, doing this involves parsing more of the server's response. In some cases, this part of the response may not appear in the first packet returned by the server, and so tls_sockets() would need to request more data. This is already done in https://github.com/dcooper16/testssl.sh/tree/extended_tls_sockets, and so I added a sockets version of the test for supported elliptic curves to that version of testssl.sh. However, I don't think we want to make such significant changes to tls_sockets() and parse_tls_serverhello() in v2.8, so I think a sockets version of the test for supported elliptic curves should wait until after v2.8 is done.\r\n\r\nP.S. The reason that I don't use \"$OPENSSL ecparam -list_curves\" is that $OPENSSL supports a lot of different curves (more than 80), whereas only 30 can be used for the ephemeral EC key in the ECDHE-* ciphers. I could check that a curve is locally supported before trying to use it with \"$OPENSSL s_client\", but there doesn't seem to be any benefit in doing that as opposed to get getting a error response from \"$OPENSSL s_client\"."},"comment":{"url":"https://api.github.com/repos/drwetter/testssl.sh/issues/comments/231782934","html_url":"https://github.com/drwetter/testssl.sh/pull/413#issuecomment-231782934","issue_url":"https://api.github.com/repos/drwetter/testssl.sh/issues/413","id":231782934,"user":{"login":"drwetter","id":8036727,"avatar_url":"https://avatars.githubusercontent.com/u/8036727?v=3","gravatar_id":"","url":"https://api.github.com/users/drwetter","html_url":"https://github.com/drwetter","followers_url":"https://api.github.com/users/drwetter/followers","following_url":"https://api.github.com/users/drwetter/following{/other_user}","gists_url":"https://api.github.com/users/drwetter/gists{/gist_id}","starred_url":"https://api.github.com/users/drwetter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/drwetter/subscriptions","organizations_url":"https://api.github.com/users/drwetter/orgs","repos_url":"https://api.github.com/users/drwetter/repos","events_url":"https://api.github.com/users/drwetter/events{/privacy}","received_events_url":"https://api.github.com/users/drwetter/received_events","type":"User","site_admin":false},"created_at":"2016-07-11T16:11:38Z","updated_at":"2016-07-11T16:11:38Z","body":"Beautiful, thank you!"}}
{"actor":{"display_login":"drwetter"}}