Discourage using 64-bit block ciphers

As discussed with the development team, we should start moving away from ciphers with a small block size. For OpenVPN in particular this means moving away from 64-bit block ciphers, towards 128-bit block ciphers. This patch makes a start with that by moving ciphers with a block size < 128 bits to the bottom of the --show-ciphers output, and printing a warning in the connection phase if such a cipher is used.

While touching this function, improve the output of --show-ciphers by ordering the output alphabetically, and changing the output format slightly.

---
 src/openvpn/crypto.c         |  11 +++--
 src/openvpn/crypto_mbedtls.c |  44 ++++++++++++-----
 src/openvpn/crypto_openssl.c | 111 ++++++++++++++++++++++++++++++++++---------
 tests/t_lpback.sh            |   2 +-
 4 files changed, 131 insertions(+), 37 deletions(-)

index d6d0251..6f57841 100644
@@ -825,9 +825,14 @@ init_key_ctx (struct key_ctx *ctx, struct key *key,
       dmsg (D_SHOW_KEYS, "%s: CIPHER KEY: %s", prefix,
           format_hex (key->cipher, kt->cipher_length, 0, &gc));
       dmsg (D_CRYPTO_DEBUG, "%s: CIPHER block_size=%d iv_size=%d",
-          prefix,
-          cipher_kt_block_size(kt->cipher),
-          cipher_kt_iv_size(kt->cipher));
+          prefix, cipher_kt_block_size(kt->cipher),
+	  cipher_kt_iv_size(kt->cipher));
+      if (cipher_kt_block_size(kt->cipher) < 128/8)
+	{
+	  msg (M_WARN, "WARNING: this cipher's block size is less than 128 bit "
+	      "(%d bit).  Consider using a --cipher with a larger block size.",
+	      cipher_kt_block_size(kt->cipher)*8);
+	}
     }
   if (kt->digest && kt->hmac_length > 0)
     {

index d7792cd..2052c62 100755
@@ -26,7 +26,7 @@ trap "rm -f key.$$ log.$$ ; exit 1" 0 3
 
 # Get list of supported ciphers from openvpn --show-ciphers output
 CIPHERS=$(${top_builddir}/src/openvpn/openvpn --show-ciphers | \
-            sed -e '1,/^$/d' -e s'/ .*//' -e '/^\s*$/d' | sort)
+            sed -e '/The following/,/^$/d' -e s'/ .*//' -e '/^\s*$/d')
 
 # SK, 2014-06-04: currently the DES-EDE3-CFB1 implementation of OpenSSL is
 # broken (see http://rt.openssl.org/Ticket/Display.html?id=2867), so exclude

2.7.4

Am 16.08.16 um 16:45 schrieb Steffan Karger:

ACK again from me. The patch is not C89 safe:

+ for (int nid = 0; nid < 10000; ++nid)

Arne

Your patch has been applied to the branch

commit c94b3ff0f5f1dbd4949f18f69ed3611f82a29021

Author: Steffan Karger
Date:   Tue Aug 16 16:45:42 2016 +0200

     Discourage using 64-bit block ciphers

     Signed-off-by: Steffan Karger <[email protected]...>
     Acked-by: Arne Schwabe <[email protected]...>
     Message-Id: <[email protected]...>
     URL: https://www.mail-archive.com/[email protected]/msg00029.html
     CVE: 2016-6329
     Signed-off-by: David Sommerseth <[email protected]...>

--
kind regards,

David Sommerseth