Update TLS ciphers and protocols for JDK 11 #41385

jaymode · 2019-04-19T16:58:40Z

This commit updates the default ciphers and TLS protocols that are used
after the minimum supported JDK is JDK 11. The conditionals around
TLSv1.3 and 256-bit cipher support have been removed. JDK 11 no longer
requires an unlimited JCE policy file for 256 bit cipher support and
TLSv1.3 is supported in JDK 11+. New cipher support has been introduced
in the newer JDK versions as well. The ciphers are ordered with PFS
ciphers being most preferred, then AEAD ciphers, and finally those with
mainstream hardware support.

This commit updates the default ciphers and TLS protocols that are used after the minimum supported JDK is JDK 11. The conditionals around TLSv1.3 and 256-bit cipher support have been removed. JDK 11 no longer requires an unlimited JCE policy file for 256 bit cipher support and TLSv1.3 is supported in JDK 11+. New cipher support has been introduced in the newer JDK versions as well. The ciphers are ordered with PFS ciphers being most preferred, then AEAD ciphers, and finally those with mainstream hardware support.

elasticmachine · 2019-04-19T16:58:42Z

Pinging @elastic/es-security

jkakavas

LGTM

jkakavas · 2019-04-22T16:01:37Z

docs/reference/settings/security-settings.asciidoc

-Jurisdiction Policy Files_ has been installed, the default value also includes `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384`,
-`TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384`, `TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA`, `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA`,
-`TLS_RSA_WITH_AES_256_CBC_SHA256`, `TLS_RSA_WITH_AES_256_CBC_SHA`.
+Java Cryptography Architecture documentation]. Defaults to `TLS_AES_256_GCM_SHA384`,


Remove the CAMELLIA/CHACHA20/ARIA ones ?

jkakavas · 2019-04-22T16:02:14Z

docs/reference/settings/security-settings.asciidoc

-Jurisdiction Policy Files_ has been installed, the default value also includes `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384`,
-`TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384`, `TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA`, `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA`,
-`TLS_RSA_WITH_AES_256_CBC_SHA256`, `TLS_RSA_WITH_AES_256_CBC_SHA`.
+Java Cryptography Architecture documentation]. Defaults to `TLS_AES_256_GCM_SHA384`,


Update the link to https://docs.oracle.com/en/java/javase/11/security/oracle-providers.html#GUID-7093246A-31A3-4304-AC5F-5FB6400405E2

tvernum

I have a question, but otherwise I'm happy.

We will want to make similar changes in lib/ssl-config, but I'm happy to take that on as a separate PR.

tvernum · 2019-04-24T05:32:17Z

x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/XPackSettings.java

+        "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", // PFS, hardware support
+        "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", // PFS, hardware support
+        "TLS_RSA_WITH_AES_128_GCM_SHA256", // AEAD, hardware support
+        "TLS_RSA_WITH_AES_128_CBC_SHA256", "TLS_RSA_WITH_AES_128_CBC_SHA"); // hardware support


I'm curious about the precise rationale for this ordering (e.g. the top 3 all have the same attributes from your explicit criteria).

Overall, it makes sense, and I don't disagree, but for example Mozilla don't recommend TLS_AES_256_GCM_SHA384 in their Modern list (because they only recommend EC), and it's on their intermediate list, but way down the bottom (partly because the don't worry about hardware support for intermediate compat).
However OWASP put that same cipher as their number 1 recommendation.

I'm not going to even attempt to adjudicate that argument, but I think this is the place to be explicit about our reasoning so we can refer back to it, if the need arises in the future.

My rationale about that is TLSv1.3 is better than TLSv1.2 and TLSv1.3 requires a TLSv1.3 cipher suite and can not use a TLSv1.2 cipher suite, so we define the TLSv1.3 cipher suite first. TLSv1.3 removes the key exchange method from the cipher suite and only supports DHE/ECDHE. Mozilla's list looks to be outdated in that it is still geared towards Java 8 and has not been updated for TLSv1.3.

This is something that I missed in the work to enable TLSv1.3 for 7.0 and will open a different PR that brings this work back to 7.x versions to correct this.

To go even further:

Forward secrecy was considered next as we don't want a recorded TLS session to be able to be decrypted.

Strong symmetric encryption is also preferred (ie 256 bit over 128 bit)

ECDSA is preferred over RSA due to its ability to scale in terms of performance and key size. RSA needs much bigger keys to achieve the same level of security as ECDSA.

AEAD is preferred over CBC due to weaknesses in CBC mode like padding oracles

SHANNN is preferred over SHA since SHA-2 overcomes issues in SHA-1

tvernum · 2019-04-30T02:06:03Z

x-pack/plugin/security/src/test/java/org/elasticsearch/test/SecuritySettingsSource.java

@@ -126,7 +126,7 @@ public Settings nodeSettings(int nodeOrdinal) {

        Settings.Builder builder = Settings.builder()
                .put(XPackSettings.SECURITY_ENABLED.getKey(), true)
-                .put(NetworkModule.TRANSPORT_TYPE_KEY, randomBoolean() ? SecurityField.NAME4 : SecurityField.NIO)
+                .put(NetworkModule.TRANSPORT_TYPE_KEY, SecurityField.NIO)//randomBoolean() ? SecurityField.NAME4 : SecurityField.NIO)


I assume this is left over debugging?

Thanks for pointing it out. It was leftover from debugging and getting help from @tbrooks8

jaymode · 2019-04-30T14:43:45Z

@elasticmachine run elasticsearch-ci/1

…th TLSv1.3

This reverts commit 315c971 due to CI failures related to this change. Some of the failures are due to JDK bugs related to TLSv1.3 such as JDK-8213202 and an endless loop in the HttpsServer when the client closes in a certain manner.

This commit updates the default ciphers and TLS protocols that are used after the minimum supported JDK is JDK 11. The conditionals around TLSv1.3 and 256-bit cipher support have been removed. JDK 11 no longer requires an unlimited JCE policy file for 256 bit cipher support and TLSv1.3 is supported in JDK 11+. New cipher support has been introduced in the newer JDK versions as well. The ciphers are ordered with PFS ciphers being most preferred, then AEAD ciphers, and finally those with mainstream hardware support.

* Update TLS ciphers and protocols for JDK 11 (#41385) This commit updates the default ciphers and TLS protocols that are used after the minimum supported JDK is JDK 11. The conditionals around TLSv1.3 and 256-bit cipher support have been removed. JDK 11 no longer requires an unlimited JCE policy file for 256 bit cipher support and TLSv1.3 is supported in JDK 11+. New cipher support has been introduced in the newer JDK versions as well. The ciphers are ordered with PFS ciphers being most preferred, then AEAD ciphers, and finally those with mainstream hardware support. * Fixes for TLSv1.3 on JDK11 * fix for JDK-8212885

* Update TLS ciphers and protocols for JDK 11 (elastic#41385) This commit updates the default ciphers and TLS protocols that are used after the minimum supported JDK is JDK 11. The conditionals around TLSv1.3 and 256-bit cipher support have been removed. JDK 11 no longer requires an unlimited JCE policy file for 256 bit cipher support and TLSv1.3 is supported in JDK 11+. New cipher support has been introduced in the newer JDK versions as well. The ciphers are ordered with PFS ciphers being most preferred, then AEAD ciphers, and finally those with mainstream hardware support. * Fixes for TLSv1.3 on JDK11 * fix for JDK-8212885

This commit updates the default ciphers and TLS protocols that are used when the runtime JDK supports them. New cipher support has been introduced in JDK 11 and 12 along with performance fixes for AES GCM. The ciphers are ordered with PFS ciphers being most preferred, then AEAD ciphers, and finally those with mainstream hardware support. When available stronger encryption is preferred for a given cipher. This is a backport of elastic#41385 and elastic#41808. There are known JDK bugs with TLSv1.3 that have been fixed in various versions. These are: 1. The JDK's bundled HttpsServer will endless loop under JDK11 and JDK 12.0 (Fixed in 12.0.1) based on the way the Apache HttpClient performs a close (half close). 2. In all versions of JDK 11 and 12, the HttpsServer will endless loop when certificates are not trusted or another handshake error occurs. An email has been sent to the openjdk security-dev list and elastic#38646 is open to track this. 3. In JDK 11.0.2 and prior there is a race condition with session resumption that leads to handshake errors when multiple concurrent handshakes are going on between the same client and server. This bug does not appear when client authentication is in use. This is JDK-8213202, which was fixed in 11.0.3 and 12.0. 4. In JDK 11.0.2 and prior there is a bug where resumed TLS sessions do not retain peer certificate information. This is JDK-8212885. The way these issues are addressed is that the current java version is checked and used to determine the supported protocols for tests that provoke these issues.

This commit updates the default ciphers and TLS protocols that are used when the runtime JDK supports them. New cipher support has been introduced in JDK 11 and 12 along with performance fixes for AES GCM. The ciphers are ordered with PFS ciphers being most preferred, then AEAD ciphers, and finally those with mainstream hardware support. When available stronger encryption is preferred for a given cipher. This is a backport of #41385 and #41808. There are known JDK bugs with TLSv1.3 that have been fixed in various versions. These are: 1. The JDK's bundled HttpsServer will endless loop under JDK11 and JDK 12.0 (Fixed in 12.0.1) based on the way the Apache HttpClient performs a close (half close). 2. In all versions of JDK 11 and 12, the HttpsServer will endless loop when certificates are not trusted or another handshake error occurs. An email has been sent to the openjdk security-dev list and #38646 is open to track this. 3. In JDK 11.0.2 and prior there is a race condition with session resumption that leads to handshake errors when multiple concurrent handshakes are going on between the same client and server. This bug does not appear when client authentication is in use. This is JDK-8213202, which was fixed in 11.0.3 and 12.0. 4. In JDK 11.0.2 and prior there is a bug where resumed TLS sessions do not retain peer certificate information. This is JDK-8212885. The way these issues are addressed is that the current java version is checked and used to determine the supported protocols for tests that provoke these issues.

This commit updates the default ciphers and TLS protocols that are used after the minimum supported JDK is JDK 11. The conditionals around TLSv1.3 and 256-bit cipher support have been removed. JDK 11 no longer requires an unlimited JCE policy file for 256 bit cipher support and TLSv1.3 is supported in JDK 11+. New cipher support has been introduced in the newer JDK versions as well. The ciphers are ordered with PFS ciphers being most preferred, then AEAD ciphers, and finally those with mainstream hardware support.

This reverts commit 315c971 due to CI failures related to this change. Some of the failures are due to JDK bugs related to TLSv1.3 such as JDK-8213202 and an endless loop in the HttpsServer when the client closes in a certain manner.

* Update TLS ciphers and protocols for JDK 11 (elastic#41385) This commit updates the default ciphers and TLS protocols that are used after the minimum supported JDK is JDK 11. The conditionals around TLSv1.3 and 256-bit cipher support have been removed. JDK 11 no longer requires an unlimited JCE policy file for 256 bit cipher support and TLSv1.3 is supported in JDK 11+. New cipher support has been introduced in the newer JDK versions as well. The ciphers are ordered with PFS ciphers being most preferred, then AEAD ciphers, and finally those with mainstream hardware support. * Fixes for TLSv1.3 on JDK11 * fix for JDK-8212885

jaymode added >enhancement :Security/TLS SSL/TLS, Certificates v8.0.0 labels Apr 19, 2019

jaymode requested review from tvernum and jkakavas April 19, 2019 16:58

jaymode added 2 commits April 22, 2019 08:53

Merge branch 'master' into jdk11_tls

8e88ca4

aria and camellia are defined but not actually implemented in the JDK

25f812a

jkakavas approved these changes Apr 22, 2019

View reviewed changes

jaymode added 4 commits April 22, 2019 10:34

fix docs

4d1967e

ensure we trust the testnode_ec cert

5339d47

Merge branch 'master' into jdk11_tls

5c253e4

Merge branch 'master' into jdk11_tls

d418c39

tvernum reviewed Apr 24, 2019

View reviewed changes

jaymode added 5 commits April 24, 2019 14:05

Merge branch 'master' into jdk11_tls

5479d11

fix nio transport issue and pin renegotiation test to TLSv1.2

52edf57

Merge branch 'master' into jdk11_tls

c6f5eb7

update in ssl lib and reorder

079cd3a

Merge branch 'master' into jdk11_tls

eb6c860

tvernum approved these changes Apr 26, 2019

View reviewed changes

jaymode added 6 commits April 26, 2019 08:15

Merge branch 'master' into jdk11_tls

ef81541

update test certs

8bad4fd

Merge branch 'master' into jdk11_tls

e59a1b8

remove unnecessary log statement

844e597

busted trust restrictions tests

ad12647

fixed mistake

31afd19

tvernum reviewed Apr 30, 2019

View reviewed changes

jaymode added 2 commits April 30, 2019 07:44

unused import

9e4672d

Merge branch 'master' into jdk11_tls

d8cec06

jaymode added 2 commits April 30, 2019 08:02

debugging leftover

d13407a

test fix

1082da2

jaymode added 5 commits April 30, 2019 11:53

some test fixes

b6bb085

pin reindex client tests to tlsv1.2 since mockwebserver has issues wi…

fc57894

…th TLSv1.3

Merge branch 'master' into jdk11_tls

16fa1c2

Merge branch 'master' into jdk11_tls

36c54d1

Merge branch 'master' into jdk11_tls

8ffd609

jaymode merged commit 315c971 into elastic:master May 2, 2019

jaymode deleted the jdk11_tls branch May 2, 2019 17:54

jaymode mentioned this pull request May 3, 2019

Update TLS ciphers and protocols for JDK 11 #41808

Merged

jaymode removed the v8.0.0 label May 3, 2019

jaymode mentioned this pull request May 10, 2019

Update ciphers for TLSv1.3 and JDK11 if available #42082

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update TLS ciphers and protocols for JDK 11 #41385

Update TLS ciphers and protocols for JDK 11 #41385

jaymode commented Apr 19, 2019

elasticmachine commented Apr 19, 2019

jkakavas left a comment

jkakavas Apr 22, 2019

jkakavas Apr 22, 2019

tvernum left a comment

tvernum Apr 24, 2019

jaymode Apr 25, 2019

jaymode Apr 25, 2019

tvernum Apr 30, 2019

jaymode Apr 30, 2019

jaymode commented Apr 30, 2019

Update TLS ciphers and protocols for JDK 11 #41385

Update TLS ciphers and protocols for JDK 11 #41385

Conversation

jaymode commented Apr 19, 2019

elasticmachine commented Apr 19, 2019

jkakavas left a comment

Choose a reason for hiding this comment

jkakavas Apr 22, 2019

Choose a reason for hiding this comment

jkakavas Apr 22, 2019

Choose a reason for hiding this comment

tvernum left a comment

Choose a reason for hiding this comment

tvernum Apr 24, 2019

Choose a reason for hiding this comment

jaymode Apr 25, 2019

Choose a reason for hiding this comment

jaymode Apr 25, 2019

Choose a reason for hiding this comment

tvernum Apr 30, 2019

Choose a reason for hiding this comment

jaymode Apr 30, 2019

Choose a reason for hiding this comment

jaymode commented Apr 30, 2019