Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-26015

Remove DH param stuff

    XMLWordPrintable

Details

    • Bug
    • Status: Closed (View Workflow)
    • Critical
    • Resolution: Fixed
    • 10.2(EOL), 10.3(EOL), 10.4(EOL), 10.5(EOL), 10.6(EOL)
    • 13.2.1
    • SSL
    • Notable changes
    • Hide
      TLS: Insecure fixed DH params, are "MUST NOT [be used for server]" per RFC-10015. As all TLSv1.3 and most ciphers in TLSv1.2 don't use DH, any client crypto library from the last 10 years is expected to have no connection troubles; Thank you Dimitri John Ledkov for the contribution fixing this issue.
      Show
      TLS: Insecure fixed DH params, are "MUST NOT [be used for server]" per RFC-10015. As all TLSv1.3 and most ciphers in TLSv1.2 don't use DH, any client crypto library from the last 10 years is expected to have no connection troubles; Thank you Dimitri John Ledkov for the contribution fixing this issue.

    Description

      The size of DH (Diffie Hellmann) group parameter in MariaDB Server cannot be changed, since it uses a fixed size of 2048.

      Citing OpenSSL Wiki:
      "Your Diffie-Hellman group parameters should match the key size used in the server's certificate. If you use a 2048-bit RSA prime in the server's certificate, then use a 2048-bit Diffie-Hellman group for key agreement."

      Citing manpage for SSL_CTX_set_tmp_dh

      "Applications may supply their own DH parameters instead of using the built-in values.
      This approach is discouraged and applications should in preference use the built-in parameter support described above.
      ....
      If "auto" DH parameters are switched on then the parameters will be selected to be consistent with the size of the key associated with the server's certificate.”

      So easiest solution would be to use SSL_CTX_set_auto_dh() instead.

      Please also note that the current code for DH params doesn't work with OSSL3 anymore.

      Attachments

        Issue Links

          is part of

          Task - A task that needs to be done. MDEV-25785 Add support for OpenSSL 3.0

          • Blocker - Blocks development and/or testing work, production could not run.
          • Closed

          Activity

            People

              danblack Daniel Black
              georg Georg Richter
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Time Tracking

                  Estimated:
                  Original Estimate - 0d
                  0d
                  Remaining:
                  Remaining Estimate - 0d
                  0d
                  Logged:
                  Time Spent - 1.25h
                  1.25h

                  Git Integration

                    Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.