Repository navigation
[OpenSSL 3] OpenSSL::Cipher.new fails with supported cipher #500
Description
net-ssh has some test failures because it tries to call OpenSSL::Cipher.new with the following ciphers: bf-cbc, bf-ecb, cast-cbc, and cast5-ecb. The error is: OpenSSL::Cipher::CipherError: unsupported.
I checked if those ciphers are still supported in the OpenSSL 3 library version available in Ubuntu and they are:
$ openssl version
OpenSSL 3.0.1 14 Dec 2021 (Library: OpenSSL 3.0.1 14 Dec 2021)
$ irb
irb(main):001:0> require 'openssl'
=> true
irb(main):002:0> OpenSSL::Cipher.ciphers.include?('cast5-ecb')
=> true
irb(main):003:0> OpenSSL::Cipher.new('cast5-ecb')
(irb):3:in `initialize': unsupported (OpenSSL::Cipher::CipherError)
from (irb):13:in `new'
from (irb):13:in `<main>'
from /usr/lib/ruby/gems/3.0.0/gems/irb-1.3.5/exe/irb:11:in `<top (required)>'
from /usr/bin/irb:23:in `load'
from /usr/bin/irb:23:in `<main>'
With OpenSSL 1.1.1f it works just fine:
$ openssl version
OpenSSL 1.1.1f 31 Mar 202
$ irb
irb(main):001:0> require 'openssl'
=> true
irb(main):002:0> OpenSSL::Cipher.ciphers.include?('cast5-ecb')
=> true
irb(main):003:0> OpenSSL::Cipher.new('cast5-ecb')
=> #<OpenSSL::Cipher:0x0000558d761cdcf8>
AFAIU those calls to OpenSSL::Cipher.new should work since the cipher is available in OpenSSL::Cipher::ciphers. Please, correct me if I am wrong.
Activity
rhenium commentedon Apr 16, 2022
In OpenSSL 3.0, these algorithms belong to the OpenSSL legacy provider. The legacy provider is not enabled by default in a fresh installation of OpenSSL 3.0 and has to be enabled using
openssl.cnf.https://www.openssl.org/docs/man3.0/man7/OSSL_PROVIDER-legacy.html
It could also be programmatically by using "propquery" string of
EVP_PKEY_CTX_new_from_name(), but this is currently not available through ruby/openssl.rhenium commentedon Apr 16, 2022
It lists known OIDs/algorithm names for which an implementation can be registered, rather than actually available algorithms. I'm not sure if there is any way to know the latter using OpenSSL API.
The rdoc should probably be clarified.
paulvt commentedon Apr 28, 2022
The still in-use NTLM authentication, mainly supported by the rubyntlm, probably needs a way to reach this functionality to be able to access the RC4 and DES-CBC ciphers, as well as the MD4 digest.
Can this be added somehow?
I saw that the gss-ntlmsspi also added code to load the legacy provider for the same reason, see: https://github.com/gssapi/gss-ntlmssp/pull/72/files
HoneyryderChuck commentedon Feb 21, 2023
Experiencing the same issue in netsnmp, following.