1346502 - Thunderbird cannot connect to SSL/TLS servers that are restricted to a small set of SHA256/SHA384 cipher suites

Status: RESOLVED WORKSFORME

(Thunderbird :: Security, defect)

Description

[bugzilla]

User Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
Build ID: 20170306104139

Steps to reproduce:

Try to connect to an server which don't provides cipher suites with sha1.


Actual results:

SSL/TLS hand share error's.


Expected results:

Connect to server which don't use sha1.

Comment 1

[Jorg K (CEST = GMT+2)]

Magnus, who could we consult here?

Comment 2

[Magnus Melin [:mkmelin]]

Well it's anticipateds that sha1 will start to fail, as that's being phased out. I think for now you can set security.pki.sha1_enforcement_level to 0 to make it work during a transition period.

Comment 3

[Jorg K (CEST = GMT+2)]

The reporter said that it doesn't work on servers which do *not* provide cipher suites with sha1, that is, servers which have already deprecated it. So that shouldn't fail, should it?

Comment 4

[bugzilla]

Here an sample imaps/smtps tls report for an serve on which thunderbird can't connect.
PORT    STATE SERVICE
993/tcp open  imaps
| ssl-enum-ciphers: 
|   TLSv1.2: 
|     ciphers: 
|       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp384r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp384r1) - A
|       TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 4096) - A
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (dh 4096) - A
|     compressors: 
|       NULL
|     cipher preference: server

25/tcp open  smtp
| ssl-enum-ciphers: 
|   TLSv1.2: 
|     ciphers: 
|       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp384r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp384r1) - A
|       TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 4096) - A
|       TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (dh 4096) - A
|     compressors: 
|       NULL
|     cipher preference: server

Comment 5

[Magnus Melin [:mkmelin]]

Ah right, I read it the other way around.

Maybe have a look at bug 1335346 (which may be similar, there is debugging hints there)

Comment 6

[Kai Engert [:KaiE:]]

The example server has high requirements for ciphersuite strength, but apparently there's no overlap with the set that is enabled by default.

I haven't tested default thundebird, but a recent Fedora build offered:
            cipher_suites[11] = {
                (0xc02b) TLS/ECDHE-ECDSA/AES128-GCM/SHA256
                (0xc02f) TLS/ECDHE-RSA/AES128-GCM/SHA256
                (0xc00a) TLS/ECDHE-ECDSA/AES256-CBC/SHA
                (0xc009) TLS/ECDHE-ECDSA/AES128-CBC/SHA
                (0xc013) TLS/ECDHE-RSA/AES128-CBC/SHA
                (0xc014) TLS/ECDHE-RSA/AES256-CBC/SHA
                (0x0033) TLS/DHE-RSA/AES128-CBC/SHA
                (0x0039) TLS/DHE-RSA/AES256-CBC/SHA
                (0x002f) TLS/RSA/AES128-CBC/SHA
                (0x0035) TLS/RSA/AES256-CBC/SHA
                (0x000a) SSL3/RSA/3DES192EDE-CBC/SHA
            }

It should be investigated, if the list of ciphersuites enabled by default could be increased.

I don't know if Thunderbird uses a smaller set of enabled ciphersuites than Firefox. If yes, and if there isn't a specific reason to do so, it might be a good idea to change Thunderbird to use the same list of Firefox.

Comment 7

[Alicja Kario]

that looks like a regression to bug 975832, at least on Thunderbird side

From what I can tell, Firefox does enable AES-256-GCM ciphers now.

Also, disabling ciphers that use SHA-1 HMAC in TLSv1.2 is completely premature. There still are no attacks that break MD5 HMACs, let alone SHA-1 HMAC.

If one is worried about SHA-1 use in TLS, disabling its use in Signature Algorithms and disabling TLS1.1 and earlier is of much higher importance.

Comment 8

[Richard Marti (:Paenglab)]

Bug 975832 has a milestone 49.0a1. This ciphers aren't enabled in TB 45. TB 52 should be out around next week.

Comment 9

[bugzilla]

Version 52 has fix it.