{"action":"created","issue":{"url":"https://api.github.com/repos/openssl/openssl/issues/5392","repository_url":"https://api.github.com/repos/openssl/openssl","labels_url":"https://api.github.com/repos/openssl/openssl/issues/5392/labels{/name}","comments_url":"https://api.github.com/repos/openssl/openssl/issues/5392/comments","events_url":"https://api.github.com/repos/openssl/openssl/issues/5392/events","html_url":"https://github.com/openssl/openssl/pull/5392","id":297833082,"number":5392,"title":"WIP: Split configuration of TLSv1.3 ciphers from older ciphers","user":{"login":"mattcaswell","id":7422273,"avatar_url":"https://avatars0.githubusercontent.com/u/7422273?v=4","gravatar_id":"","url":"https://api.github.com/users/mattcaswell","html_url":"https://github.com/mattcaswell","followers_url":"https://api.github.com/users/mattcaswell/followers","following_url":"https://api.github.com/users/mattcaswell/following{/other_user}","gists_url":"https://api.github.com/users/mattcaswell/gists{/gist_id}","starred_url":"https://api.github.com/users/mattcaswell/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mattcaswell/subscriptions","organizations_url":"https://api.github.com/users/mattcaswell/orgs","repos_url":"https://api.github.com/users/mattcaswell/repos","events_url":"https://api.github.com/users/mattcaswell/events{/privacy}","received_events_url":"https://api.github.com/users/mattcaswell/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":17,"created_at":"2018-02-16T15:59:53Z","updated_at":"2018-02-19T18:41:55Z","closed_at":null,"author_association":"OWNER","pull_request":{"url":"https://api.github.com/repos/openssl/openssl/pulls/5392","html_url":"https://github.com/openssl/openssl/pull/5392","diff_url":"https://github.com/openssl/openssl/pull/5392.diff","patch_url":"https://github.com/openssl/openssl/pull/5392.patch"},"body":"With the current mechanism, old cipher strings that used to work in 1.1.0,\r\nmay inadvertently disable all TLSv1.3 ciphersuites causing connections to\r\nfail. This is confusing for users.\r\n\r\nIn reality TLSv1.3 are quite different to older ciphers. They are much\r\nsimpler and there are only a small number of them so, arguably, they don't\r\nneed the same level of control that the older ciphers have.\r\n\r\nThis change splits the configuration of TLSv1.3 ciphers from older ones.\r\nBy default the TLSv1.3 ciphers are on, so you cannot inadvertently disable\r\nthem through your existing config.\r\n\r\nFixes #5359\r\n\r\nThis is WIP because it still needs documentation - but I wanted to see if there were any substantive comments before writing that.\r\n\r\nA few things to note about this (which may or may not be controversial):\r\n\r\n- I have taken the opportunity to replace the OpenSSL specific names for the ciphersuites with the RFC standard names. The only reason to have OpenSSL specific ones was to make them a bit more consistent with the rest of the ciphersuite names. Now that they are treated differently anyway that reason seems less compelling (if it ever was).\r\n\r\n- This PR also changes the default ordering of the TLSv1.3 ciphersuites. Previously the TLSv1.3 ciphersuites were mixed in with the rest of the ciphersuites in the order \"TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256\". Now they are at the top of the ciphersuites list (on the basis that we would rather use these TLSv1.3 ciphersuites than older ones) and in the order \"TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384\". This is on the basis that AES-256 seems overkill for the default choice (it also has the side benefit that the default hash will now be SHA-256 which is one step towards easing the PSK transition as discussed in #5378). I'm not sure which we would prefer as the top choice out of the AES vs chacha20 ciphersuites. Note this is slightly inconsistent with the default ordering of the older ciphersuites which are sorted by strength (so AES-256 is preferred over AES-128). Since we are handling the two lists differently, I kind of think that is ok.\r\n\r\n- I have added new functions `SSL_CTX_set_ciphersuites()`/`SSL_set_ciphersuites()` for configuring the TLSv1.3 specific ciphersuites. There is also a new \"Ciphersuites\" SSL_CONF parameter, as well as a new \"-ciphersuites\" command line option for s_server/s_client/ciphers.\r\n\r\n- We possibly need `SSL_CTX_get0_ciphersuites()` and `SSL_get0_ciphersuites()` too.\r\n\r\n- Under the hood the TLSv1.3 ciphersuites still get added into the same cipher_list as all the others. This is visible to an application if it calls `SSL_get_ciphers()` et al.\r\n<!--\r\nThank you for your pull request. Please review these requirements:\r\n\r\nContributors guide: https://github.com/openssl/openssl/blob/master/CONTRIBUTING\r\n\r\nOther than that, provide a description above this comment if there isn't one already\r\n\r\nIf this fixes a github issue, make sure to have a line saying 'Fixes #XXXX' (without quotes) in the commit message.\r\n-->\r\n\r\n##### Checklist\r\n<!-- Remove items that do not apply. For completed items, change [ ] to [x]. -->\r\n- [ ] documentation is added or updated\r\n- [x] tests are added or updated\r\n"},"comment":{"url":"https://api.github.com/repos/openssl/openssl/issues/comments/366774756","html_url":"https://github.com/openssl/openssl/pull/5392#issuecomment-366774756","issue_url":"https://api.github.com/repos/openssl/openssl/issues/5392","id":366774756,"user":{"login":"mattcaswell","id":7422273,"avatar_url":"https://avatars0.githubusercontent.com/u/7422273?v=4","gravatar_id":"","url":"https://api.github.com/users/mattcaswell","html_url":"https://github.com/mattcaswell","followers_url":"https://api.github.com/users/mattcaswell/followers","following_url":"https://api.github.com/users/mattcaswell/following{/other_user}","gists_url":"https://api.github.com/users/mattcaswell/gists{/gist_id}","starred_url":"https://api.github.com/users/mattcaswell/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mattcaswell/subscriptions","organizations_url":"https://api.github.com/users/mattcaswell/orgs","repos_url":"https://api.github.com/users/mattcaswell/repos","events_url":"https://api.github.com/users/mattcaswell/events{/privacy}","received_events_url":"https://api.github.com/users/mattcaswell/received_events","type":"User","site_admin":false},"created_at":"2018-02-19T18:41:55Z","updated_at":"2018-02-19T18:41:55Z","author_association":"OWNER","body":"> I'm wondering if in the new configuration you say \"AES\", or\r\n\"AES-256-GCM-SHA384\", that you're going to enable the TLS 1.2\r\nciphers that match that or not, or if this is going to be a TLS\r\n1.3 setting only.\r\n\r\nNo. The new configuration settings for TLSv1.3 are a simple list of the allowed ciphersuites. It does not have all the functionality of the TLSv1.2 cipher list (it's not needed - there are currently only 5 permissible values). It is not possible to specify \"AES\" in the list for TLSv1.3 because it is not a ciphersuite name."}}
{"actor":{"display_login":"mattcaswell"}}