Messaggi di ::1 @ Forum ad alta digeribilità

☺

Scritto da

::1

il 2013-10-14 20:52:15.0 alle 2013-10-14 20:52:15.0

Trollate totali: 12321

Re: Why Android SSL was downgraded from AES256-SHA to RC4-MD5 in late 2010

Scritto da:
> > > > http://op-co.de/blog/posts/android_ssl_downgrade/

> > >
> > > Il SSL usato da Firefox e altri browser cosa usa?
> >
> > Su android? se usano l'implementazione di default usa quella descritta nell'articolo.
>
> No volevo dire su Windows e Linux.

Provato in locale, generando una ca con il seguente script:

#!/bin/sh

#Country
C=XX

#State
ST=Internet

#Organization
O="localhost"

function subject() {
  #Common Name
  CN="$1"
  echo -n /C=$C/ST=$ST/O=$O/CN=$CN
}

case "$1" in
  gen-conf)
    sed 's:^dir[^a-z]*=.*$:dir = '$PWD':g' /etc/ssl/openssl.cnf | \
      sed 's:^default_days.*=.*365:default_days = 3650:' > openssl.cnf
    ;;
  gen-ca)
    openssl genrsa -out ca.key 4096
    SUBJECT="$(subject ca)"
    openssl req -new -subj "$SUBJECT" -key ca.key -out ca.csr -batch
    openssl x509 -req -in ca.csr -out ca.crt -signkey ca.key
    touch index.txt
    echo 01 > serial
    mkdir newcerts
    mkdir private
    cp ca.key private/cakey.pem
    cp ca.crt cacert.pem
    ;;
  gen-client)
    SERIAL=$(cat serial)
    CN="$2"
    SUBJECT=$(subject "$CN")
    KEY=client-${SERIAL}.key
    CSR=client-${SERIAL}.csr
    CRT=client-${SERIAL}.crt
    P12=client-${SERIAL}.p12
    openssl genrsa -out $KEY
    openssl req -new -subj "$SUBJECT" -key $KEY -out $CSR -batch
    openssl ca -config openssl.cnf -in $CSR -cert ca.crt -keyfile ca.key -out $CRT -batch
    openssl pkcs12 -export -clcerts -in $CRT -inkey $KEY -out $P12 -password pass:
    ;;
  *)
    echo "$0 (gen-conf|gen-ca|gen-client \$CN)"
esac

Trattasi di manuscripto del sottoscripto che uso per gestire i certificati sul mio server dove mi autentico solo con certificati ssl (sì, potrei generare le chiavi e csr in locale e certificare in remoto, sarebbe più sicuro, ma mi basta anche così...).

Salvato come ca.sh, lanciato così:

./ca.sh gen-conf
./ca.sh gen-ca

Coi certificati appena creati creo un test server con openssl:

openssl s_server -accept 8443 -key ca.key -cert ca.crt -www

Puntando il browser su http://localhost:8443/

ottengo la seguente pagina:




s_server -accept 8443 -key ca.key -cert ca.crt -www 
Secure Renegotiation IS supported
Ciphers supported in s_server binary
TLSv1/SSLv3:ECDHE-RSA-AES256-GCM-SHA384TLSv1/SSLv3:ECDHE-ECDSA-AES256-GCM-SHA384
TLSv1/SSLv3:ECDHE-RSA-AES256-SHA384  TLSv1/SSLv3:ECDHE-ECDSA-AES256-SHA384
TLSv1/SSLv3:ECDHE-RSA-AES256-SHA     TLSv1/SSLv3:ECDHE-ECDSA-AES256-SHA   
TLSv1/SSLv3:SRP-DSS-AES-256-CBC-SHA  TLSv1/SSLv3:SRP-RSA-AES-256-CBC-SHA  
TLSv1/SSLv3:DHE-DSS-AES256-GCM-SHA384TLSv1/SSLv3:DHE-RSA-AES256-GCM-SHA384
TLSv1/SSLv3:DHE-RSA-AES256-SHA256    TLSv1/SSLv3:DHE-DSS-AES256-SHA256    
TLSv1/SSLv3:DHE-RSA-AES256-SHA       TLSv1/SSLv3:DHE-DSS-AES256-SHA       
TLSv1/SSLv3:DHE-RSA-CAMELLIA256-SHA  TLSv1/SSLv3:DHE-DSS-CAMELLIA256-SHA  
TLSv1/SSLv3:ECDH-RSA-AES256-GCM-SHA384TLSv1/SSLv3:ECDH-ECDSA-AES256-GCM-SHA384
TLSv1/SSLv3:ECDH-RSA-AES256-SHA384   TLSv1/SSLv3:ECDH-ECDSA-AES256-SHA384 
TLSv1/SSLv3:ECDH-RSA-AES256-SHA      TLSv1/SSLv3:ECDH-ECDSA-AES256-SHA    
TLSv1/SSLv3:AES256-GCM-SHA384        TLSv1/SSLv3:AES256-SHA256            
TLSv1/SSLv3:AES256-SHA               TLSv1/SSLv3:CAMELLIA256-SHA          
TLSv1/SSLv3:PSK-AES256-CBC-SHA       TLSv1/SSLv3:ECDHE-RSA-DES-CBC3-SHA   
TLSv1/SSLv3:ECDHE-ECDSA-DES-CBC3-SHA TLSv1/SSLv3:SRP-DSS-3DES-EDE-CBC-SHA 
TLSv1/SSLv3:SRP-RSA-3DES-EDE-CBC-SHA TLSv1/SSLv3:EDH-RSA-DES-CBC3-SHA     
TLSv1/SSLv3:EDH-DSS-DES-CBC3-SHA     TLSv1/SSLv3:ECDH-RSA-DES-CBC3-SHA    
TLSv1/SSLv3:ECDH-ECDSA-DES-CBC3-SHA  TLSv1/SSLv3:DES-CBC3-SHA             
TLSv1/SSLv3:PSK-3DES-EDE-CBC-SHA     TLSv1/SSLv3:ECDHE-RSA-AES128-GCM-SHA256
TLSv1/SSLv3:ECDHE-ECDSA-AES128-GCM-SHA256TLSv1/SSLv3:ECDHE-RSA-AES128-SHA256  
TLSv1/SSLv3:ECDHE-ECDSA-AES128-SHA256TLSv1/SSLv3:ECDHE-RSA-AES128-SHA     
TLSv1/SSLv3:ECDHE-ECDSA-AES128-SHA   TLSv1/SSLv3:SRP-DSS-AES-128-CBC-SHA  
TLSv1/SSLv3:SRP-RSA-AES-128-CBC-SHA  TLSv1/SSLv3:DHE-DSS-AES128-GCM-SHA256
TLSv1/SSLv3:DHE-RSA-AES128-GCM-SHA256TLSv1/SSLv3:DHE-RSA-AES128-SHA256    
TLSv1/SSLv3:DHE-DSS-AES128-SHA256    TLSv1/SSLv3:DHE-RSA-AES128-SHA       
TLSv1/SSLv3:DHE-DSS-AES128-SHA       TLSv1/SSLv3:DHE-RSA-SEED-SHA         
TLSv1/SSLv3:DHE-DSS-SEED-SHA         TLSv1/SSLv3:DHE-RSA-CAMELLIA128-SHA  
TLSv1/SSLv3:DHE-DSS-CAMELLIA128-SHA  TLSv1/SSLv3:ECDH-RSA-AES128-GCM-SHA256
TLSv1/SSLv3:ECDH-ECDSA-AES128-GCM-SHA256TLSv1/SSLv3:ECDH-RSA-AES128-SHA256   
TLSv1/SSLv3:ECDH-ECDSA-AES128-SHA256 TLSv1/SSLv3:ECDH-RSA-AES128-SHA      
TLSv1/SSLv3:ECDH-ECDSA-AES128-SHA    TLSv1/SSLv3:AES128-GCM-SHA256        
TLSv1/SSLv3:AES128-SHA256            TLSv1/SSLv3:AES128-SHA               
TLSv1/SSLv3:SEED-SHA                 TLSv1/SSLv3:CAMELLIA128-SHA          
TLSv1/SSLv3:IDEA-CBC-SHA             TLSv1/SSLv3:PSK-AES128-CBC-SHA       
TLSv1/SSLv3:ECDHE-RSA-RC4-SHA        TLSv1/SSLv3:ECDHE-ECDSA-RC4-SHA      
TLSv1/SSLv3:ECDH-RSA-RC4-SHA         TLSv1/SSLv3:ECDH-ECDSA-RC4-SHA       
TLSv1/SSLv3:RC4-SHA                  TLSv1/SSLv3:RC4-MD5                  
TLSv1/SSLv3:PSK-RC4-SHA              TLSv1/SSLv3:EDH-RSA-DES-CBC-SHA      
TLSv1/SSLv3:EDH-DSS-DES-CBC-SHA      TLSv1/SSLv3:DES-CBC-SHA              
TLSv1/SSLv3:EXP-EDH-RSA-DES-CBC-SHA  TLSv1/SSLv3:EXP-EDH-DSS-DES-CBC-SHA  
TLSv1/SSLv3:EXP-DES-CBC-SHA          TLSv1/SSLv3:EXP-RC2-CBC-MD5          
TLSv1/SSLv3:EXP-RC4-MD5              
---
Ciphers common between both SSL end points:
ECDHE-ECDSA-AES256-SHA     ECDHE-RSA-AES256-SHA       DHE-RSA-CAMELLIA256-SHA   
DHE-DSS-CAMELLIA256-SHA    DHE-RSA-AES256-SHA         DHE-DSS-AES256-SHA        
ECDH-RSA-AES256-SHA        ECDH-ECDSA-AES256-SHA      CAMELLIA256-SHA           
AES256-SHA                 ECDHE-ECDSA-RC4-SHA        ECDHE-ECDSA-AES128-SHA    
ECDHE-RSA-RC4-SHA          ECDHE-RSA-AES128-SHA       DHE-RSA-CAMELLIA128-SHA   
DHE-DSS-CAMELLIA128-SHA    DHE-RSA-AES128-SHA         DHE-DSS-AES128-SHA        
ECDH-RSA-RC4-SHA           ECDH-RSA-AES128-SHA        ECDH-ECDSA-RC4-SHA        
ECDH-ECDSA-AES128-SHA      SEED-SHA                   CAMELLIA128-SHA           
RC4-SHA                    RC4-MD5                    AES128-SHA                
ECDHE-ECDSA-DES-CBC3-SHA   ECDHE-RSA-DES-CBC3-SHA     EDH-RSA-DES-CBC3-SHA      
EDH-DSS-DES-CBC3-SHA       ECDH-RSA-DES-CBC3-SHA      ECDH-ECDSA-DES-CBC3-SHA   
DES-CBC3-SHA
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-SHA
SSL-Session:
    Protocol  : TLSv1.1
    Cipher    : ECDHE-RSA-AES256-SHA
    Session-ID: 
    Session-ID-ctx: 01000000
    Master-Key: CBE0CABC99DD549132C4BF7C07737E836409D2052D648F55B0761A95D39A12D601319DDDB08326C6F23459EB7B870FE9
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1381776417
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---
   0 items in the session cache
   0 client connects (SSL_connect())
   0 client renegotiates (SSL_connect())
   0 client connects that finished
   3 server accepts (SSL_accept())
   0 server renegotiates (SSL_accept())
   3 server accepts that finished
   0 session cache hits
   0 session cache misses
   0 session cache timeouts
   0 callback cache hits
   0 cache full overflows (128 allowed)
---
no client certificate available

Ho soddisfatto la tua curiosità?

Young professional woman and busy mom.

Forum libero

Arricchimento culturale in Svezia in corso

Vieni anche tu in gita in Africa!

Multiculturalismo a Bruxelles

Black Woman Destroys White Privilege Myth

Trova Wakanda!