Implement TLS_ECDSA_SIGN_SHA256_OID (prevents access to Cloudflare Domains) about tlse HOT 16 CLOSED

Hello! I’m fine, thank you Ron, still sailing. Hope to get back sometime at the end of this month. I will update this soon. Now I’m enjoying the nice weather and the breeze.

from tlse.

Note this only applied to TLS1.2 with ECDSA. TLS 1.3 works fine.

from tlse.

Were you able to implement a fix for this?

from tlse.

No, I don't know enough about ECDSA (yet) to do this properly. For now, I'm using a fallback in my own fork, see the flowchart at the end of https://github.com/turbo/nuTLS

from tlse.

Thanks. Hopefully Eduard is ok and will make an appearance soon.

from tlse.

Oh, I'm happy to hear that! Be well and stay safe.

from tlse.

That's good to hear!

Side note: if you want to get rid of the google license if x25519 is used, the NaCl code (public domain) works as a drop-in replacement, see: https://github.com/turbo/nuTLS/blob/master/nutls.c#L18563-L18815

from tlse.

It looks like one of my issues is actually this. Perhaps both of them are.

from tlse.

@turbo, can you provide a test domain for this issue?

Thanks!

from tlse.

Feel free to use the domains from the issue. std.fyi is my domain.

from tlse.

I'm trying to understand what is happening. I'm getting an alert, just after the hello message (0x28 - I think this is handshake failure). I'm not sure why... TLSe already reports supporting ecdsa_secp256r1_sha256(0x0403)... but I get this alert. Does anyone has some idea why?

from tlse.

I think I'm seeing the same thing from a user trying to access https://api.tiingo.com/

from tlse.

Enabling DEBUG in tlssimple.c with the 'api.tiigo.com' host, I get:

Initializing dependencies
Message type: 15, length: 2
ALERT MESSAGE
02 50 Consumed -12 bytes
ERROR IN CONSUME: -12
SSL write error -6

from tlse.

It seems that SHA384 ciphers don't work as expected. If I remove the SHA348 ciphers, everything works fine.

from tlse.

Ok, fixed the SHA384 issue, @ronaaron, now it should be ok. It seems that there were multiple issues with the client hello. I use this library mainly as a server so thank you for testing the client.

from tlse.

Excellent work, Eduard. I can confirm that the problem I was having with that one site is over (had to specify TLS ver 1.3 to connect, but it now works).

from tlse.