<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<div>
<div id="x_compose-container" itemscope="" itemtype="https://schema.org/EmailMessage" style="direction:ltr">
<span itemprop="creator" itemscope="" itemtype="https://schema.org/Organization"><span itemprop="name"></span></span>
<div>
<div style="direction:ltr">Hello,</div>
<div><br>
</div>
<div style="direction:ltr">It is a PKIX KeyManager with a loaded P12 key store. But I tried quite a few alternatives, so maybe there is something wrong within all the commented code. If you think it should work I can try to clean it up for reproduction.</div>
<div><br>
</div>
<div class="x_acompli_signature">Gruss<br>
Bernd<br>
-- <br>
<a dir="ltr" href="http://bernd.eckenfels.net">http://bernd.eckenfels.net</a></div>
</div>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Xuelei Fan <xuelei.fan@oracle.com><br>
<b>Sent:</b> Tuesday, May 23, 2017 9:12:10 PM<br>
<b>To:</b> Bernd; security-dev@openjdk.java.net<br>
<b>Subject:</b> Re: ECC Key Usage ignored with and ECDH(E) ciphers</font>
<div> </div>
</div>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">Hi Bernd,<br>
<br>
What are the JSSE key/trust managers used for the testing ("SunX509" or <br>
"PKIX")?<br>
<br>
Thanks & Regards,<br>
Xuelei<br>
<br>
On 5/23/2017 7:08 AM, Bernd wrote:<br>
> Hello,<br>
> <br>
> according to RFC 4492 the key usage for ECDHE and ECDH ciphers need to <br>
> be observed in regards to key agreement: When I use ECDH_ECDSA ciphers <br>
> then the server certificate must have the keyAgreement usage. When I use <br>
> ECDHE_ECDSA ciphers then the server certificate must have <br>
> "digitalSignature".<br>
> <br>
> # Note that there is no structural difference between ECDH and ECDSA<br>
> # keys. A certificate issuer may use X.509 v3 keyUsage and<br>
> # extendedKeyUsage extensions to restrict the use of an ECC public key<br>
> # to certain computations [15 <<a href="https://tools.ietf.org/search/rfc4492#ref-15">https://tools.ietf.org/search/rfc4492#ref-15</a>>]. This document refers to an ECC key as<br>
> # ECDH-capable if its use in ECDH is permitted. ECDSA-capable is<br>
> # defined similarly.<br>
> <br>
> <br>
> This rule is enforced by the openssl s_client: when the server proposes <br>
> a cipher which does not pass this check it will terminate the connection:<br>
> <br>
> > openssl s_client -cipher ECDHE-ECDSA-AES128-SHA256 -connect <br>
> localhost:1234<br>
> > 1252:error:1411713E:SSL routines:ssl_check_srvr_ecc_cert_and_alg:ecc <br>
> cert not for signing:.\ssl\ssl_lib.c:2512:<br>
> > 1252:error:14082130:SSL routines:ssl3_check_cert_and_algorithm:bad <br>
> ecc cert:.\ssl\s3_clnt.c:3544:<br>
> <br>
> In this case the certificate had key usage:<br>
> <br>
> > [ server-exch ]<br>
> > extendedKeyUsage = serverAuth<br>
> > basicConstraints = CA:FALSE<br>
> > keyUsage = keyAgreement<br>
> > subjectAltName=IP:127.0.0.1,DNS:localhost.<br>
> <br>
> The connect with static ECDH works:<br>
> <br>
> > openssl s_client -cipher ECDH-ECDSA-AES128-SHA256 -connect localhost:1234<br>
> ...<br>
> > SSL-Session:<br>
> > Protocol : TLSv1.2<br>
> > Cipher : ECDH-ECDSA-AES128-SHA256<br>
> <br>
> The other way around, when I use the following key usage:<br>
> <br>
> > [ server-sign ]<br>
> > extendedKeyUsage = serverAuth<br>
> > basicConstraints = CA:FALSE<br>
> > keyUsage = digitalSignature<br>
> > subjectAltName=IP:127.0.0.1,DNS:localhost.<br>
> <br>
> OpenSSL client works this way:<br>
> <br>
> >openssl s_client -cipher ECDH-ECDSA-AES128-SHA256 -connect localhost:1234<br>
> >9916:error:1411713D:SSL routines:ssl_check_srvr_ecc_cert_and_alg:ecc <br>
> cert not for key agreement<br>
> <br>
> >openssl s_client -cipher ECDHE-ECDSA-AES128-SHA256 -connect localhost:1234<br>
> >SSL-Session:<br>
> > Protocol : TLSv1.2<br>
> > Cipher : ECDHE-ECDSA-AES128-SHA256<br>
> <br>
> In both cases however JSSE (OracleJDK8u121 or OpenJDK 9-ea+162) will <br>
> offer both cipher suites and not filter them by key usage capabilties. <br>
> Would you agree this is a bug? And should this also apply to client <br>
> side? I have not tested it with RSA certificates, but I would expect <br>
> this to be the same.<br>
> <br>
> Gruss<br>
> Bernd<br>
> <br>
> PS: config file and openssl commands to create multiple ECC certificates <br>
> used for this test:<br>
> <a href="https://gist.github.com/ecki/d66d79bf0cf12872d015804f5edec6e4">https://gist.github.com/ecki/d66d79bf0cf12872d015804f5edec6e4</a><br>
> <br>
> <br>
</div>
</span></font>
</body>
</html>