I tested the master branch that adds this capability, but I’m apparently not using the right combination of flags to turn it off – when I attempt s_client/s_server in the 1.1.1dev branch, I’m still seeing the ETM extension offered and negotiated for CBC suites. What would be the correct method to disable ETM using the master branch?
Thanks,
-Mike
On 1/16/17, 9:00 AM, "openssl-users on behalf of Matt Caswell" <openssl-users-bounces@xxxxxxxxxxx on behalf of matt@xxxxxxxxxxx> wrote:
On 16/01/17 14:14, Michael Shirley wrote:
> It appears that starting with OpenSSL 1.1.0, it is not possible to
> disable the Encrypt-Then-MAC (ETM) TLS extension for CBC ciphers. Is
> there an undocumented method to do this, which would also allow me to
> use the built-in s_server/s_client test mechanism?
This is a new feature in 1.1.0 that is on by default. Unfortunately
there is no way to disable it. That capability has since been added to
the master branch (so will be in 1.1.1) via this commit:
commit cde6145ba19a2fce039cf054a89e49f67c623c59
Author: David Woodhouse <David.Woodhouse@xxxxxxxxx>
AuthorDate: Fri Oct 14 00:26:38 2016 +0100
Commit: Matt Caswell <matt@xxxxxxxxxxx>
CommitDate: Mon Oct 17 23:17:39 2016 +0100
Add SSL_OP_NO_ENCRYPT_THEN_MAC
Reviewed-by: Tim Hudson <tjh@xxxxxxxxxxx>
Reviewed-by: Matt Caswell <matt@xxxxxxxxxxx>
Matt
--
openssl-users mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
Attachment:
smime.p7s
Description: S/MIME cryptographic signature
-- openssl-users mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
