0

I'm trying to perform a ssl handshake with EC keys instead of RSA. The private key and server certificate are generated with OpenSSL. The handshake fails.

Server Code:

context.load_cert_chain(certfile='server-cert.pem', keyfile='server-key.pem')
context.set_ecdh_curve('prime192v1')
# context.load_dh_params('server-key.pem')

bindsocket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
bindsocket.bind(('localhost', 6996))
bindsocket.listen(5)


while True:
    newsocket, fromaddr = bindsocket.accept()
    connstream = context.wrap_socket(newsocket, server_side=True)
    try:
        print connstream.read()
        connstream.send('HI CLIENT#')
    finally:
        connstream.shutdown(socket.SHUT_RDWR)
        connstream.close()

Client Code:

context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
context.verify_mode = ssl.CERT_REQUIRED
context.load_verify_locations('server-cert.pem')

client = context.wrap_socket(socket.socket(socket.AF_INET, socket.SOCK_STREAM))
client.connect(('localhost', 6996))
client.send('HELLO WORLD!')
print client.read()

client.shutdown(socket.SHUT_RDWR)
client.close()

Server Error:

connstream = context.wrap_socket(newsocket, server_side=True)
  File "C:\ProgramData\Anaconda2\lib\ssl.py", line 363, in wrap_socket
    _context=self)
  File "C:\ProgramData\Anaconda2\lib\ssl.py", line 611, in __init__
    self.do_handshake()
  File "C:\ProgramData\Anaconda2\lib\ssl.py", line 840, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLError: [SSL: NO_SHARED_CIPHER] no shared cipher (_ssl.c:661)

Client Error:

client.connect(('localhost', 6996))
  File "C:\ProgramData\Anaconda2\lib\ssl.py", line 876, in connect
    self._real_connect(addr, False)
  File "C:\ProgramData\Anaconda2\lib\ssl.py", line 867, in _real_connect
    self.do_handshake()
  File "C:\ProgramData\Anaconda2\lib\ssl.py", line 840, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLError: [SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:661)

How server-key.pem looks:

-----BEGIN EC PARAMETERS-----
...
-----END EC PARAMETERS-----
-----BEGIN EC PRIVATE KEY-----
...
-----END EC PRIVATE KEY-----
w0rmh013
  • 1
  • You need a server certificate, not just an EC key. Without a server certificate the server only (theoretically) supports DH and EDH anonymous ciphersuites, which the client will not support because those are insecure (the server probably will also not support them, so in reality the server won't support any ciphersuites). – President James K. Polk Mar 08 '18 at 23:48
  • I mentioned that I did generate a certificate. And its format seems to be correct, so I assume this is not the problem? – w0rmh013 Mar 09 '18 at 16:29
  • Sorry, I missed that. I'll try a few experiments later and see if I can figure something out. – President James K. Polk Mar 09 '18 at 20:39

0 Answers0