How do you enable a disabled cipher OpenSSL

user_3255720 0
Viewed 224

I am trying to use the ADH-AES256-GCM-SHA384 cipher in node js.

All the node js code says is that you can select a cipher that is present in the tls.getCiphers() list. This cipher is not present. It is also not present in the list of default ciphers seen using openssl ciphers -V (which matches the tls.getCiphers() list).

openssl ciphers -V aNULL shows the cipher present in OpenSSL but disabled.

According to the OpenSSL website, this can only be added to the list of enabled ciphers by recompiling OpenSSL. I have the latest source code (3.0.0). I am assuming that you change the list of supported parameters by running the config script with a command line parameter, or changing a config file somewhere.

But I cannot find any reference as to where or how to do this.

Can someone please direct me to where this is documented?

Thanks in advance

node.js openssl
1 Answers

TLDR: the cipher(suite) is there

The aNULL suites are compiled in all versions of OpenSSL, even 3.0.0, although they are disabled when using the default cipherlist. You don't need to recompile anything. (And since I doubt any nodejs package yet was built against OpenSSL 3.0 which was only released a few weeks ago, and I'm not even sure it's compatible, you don't want to try to use 3.0.) I don't know why tls.getCiphers() doesn't list them; I'll try to look into that later. (Even the eNULL suites are compiled, but are excluded not only from DEFAULT but also from ALL, and must be specified explicitly or as COMPLETEMENTOFALL, which is mathematically insane. OTOH ciphers that claimed confidentiality but are broken, like RC4 and 1DES, are not compiled with the 'standard' configuration.)

However, to use an ADH ciphersuite (including the one you named), you must:

  • provide (temp)DH parameters. This is documented for DHE but the same also applies for ADH

  • specify a cipherlist that includes at least the desired suite(s), AND for OpenSSL 1.1.0 up ALSO sets @SECLEVEL=0 (since the added-in-1.1.0 global security level defaults to 1 which disables ADH)

The following works for me:

const fs = require('fs');
const tls = require('tls');
const dhparam = fs.readFileSync("n:certx/dh1parm.pem");
var svr = tls.createServer({ciphers:"aNULL:@SECLEVEL=0",dhparam}, 
    (socket)=>{console.log("connected!\n")} );
svr.listen(9889);
user_28688010
Related