Quantcast
Channel: Security
Viewing all articles
Browse latest Browse all 1881

Weak EC Diffie-Hellman Hash Algorithm when using TLS 1.2

$
0
0

During TLS 1.2 handshakes, my server (2012 R2/IIS 8.5) seems to be choosing SHA1 as the signature algorithm for the ECDHE parameters despite the fact that the client(s) and server both support better SHA2 algorithms.

Handshake Protocol: Server Key Exchange
            Handshake Type: Server Key Exchange (12)
            Length: 361
            EC Diffie-Hellman Server Params
                Curve Type: named_curve (0x03)
                Named Curve: secp384r1 (0x0018)
                Pubkey Length: 97
                Pubkey: 
                Signature Hash Algorithm: 0x0201
                    Signature Hash Algorithm Hash: SHA1 (2)
                    Signature Hash Algorithm Signature: RSA (1)
                Signature Length: 256
                Signature:

Handshake Protocol: Client Hello
            Handshake Type: Client Hello (1)
            Length: 175
            Version: TLS 1.2 (0x0303)
            ...
            Extension: signature_algorithms
                Type: signature_algorithms (0x000d)
                Length: 20
                Signature Hash Algorithms Length: 18
                Signature Hash Algorithms (9 algorithms)
                    Signature Hash Algorithm: 0x0601
                        Signature Hash Algorithm Hash: SHA512 (6)
                        Signature Hash Algorithm Signature: RSA (1)
                    Signature Hash Algorithm: 0x0401
                        Signature Hash Algorithm Hash: SHA256 (4)
                        Signature Hash Algorithm Signature: RSA (1)
                    Signature Hash Algorithm: 0x0501
                        Signature Hash Algorithm Hash: SHA384 (5)
                        Signature Hash Algorithm Signature: RSA (1)
                    Signature Hash Algorithm: 0x0201
                        Signature Hash Algorithm Hash: SHA1 (2)
                        Signature Hash Algorithm Signature: RSA (1)

I've tried all sorts of different clients, but SHA1 is always chosen during the handshake. This is what I see in the handshake when the clients connect to other servers and when my own server acts a client (to other IIS 8.5 servers even)...

EC Diffie-Hellman Server Params
    Curve Type: named_curve (0x03)
    Named Curve: secp256r1 (0x0017)
    Pubkey Length: 65
    Pubkey: ...
    Signature Hash Algorithm: 0x0601
        Signature Hash Algorithm Hash: SHA512 (6)
        Signature Hash Algorithm Signature: RSA (1)
    Signature Length: 256
    Signature: ...

Any idea what could be causing my server to select this weaker SHA1 hash algorithm to be used for ECDHE instead of SHA2 hashes? I've double checked that it's not falling back to TLS 1.0. As far as I can tell, it's staying at TLS 1.2 throughout the handshake.

Thanks!


Viewing all articles
Browse latest Browse all 1881

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>