On 16/01/17 14:14, Michael Shirley wrote:
> It appears that starting with OpenSSL 1.1.0, it is not possible to
> disable the Encrypt-Then-MAC (ETM) TLS extension for CBC ciphers. Is
> there an undocumented method to do this, which would also allow me to
> use the built-in s_server/s_client test mechanism?
This is a new feature in 1.1.0 that is on by default. Unfortunately
there is no way to disable it. That capability has since been added to
the master branch (so will be in 1.1.1) via this commit:
commit cde6145ba19a2fce039cf054a89e49f67c623c59
Author: David Woodhouse <David.Woodhouse@xxxxxxxxx>
AuthorDate: Fri Oct 14 00:26:38 2016 +0100
Commit: Matt Caswell <matt@xxxxxxxxxxx>
CommitDate: Mon Oct 17 23:17:39 2016 +0100
Add SSL_OP_NO_ENCRYPT_THEN_MAC
Reviewed-by: Tim Hudson <tjh@xxxxxxxxxxx>
Reviewed-by: Matt Caswell <matt@xxxxxxxxxxx>
Matt
--
openssl-users mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
