Drop DHE TLS ciphers

[bwbroersma]

desec-stack/www/conf/conf.d/ssl.conf

Lines 4 to 6 in 6a4ae93

	ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
	ssl_prefer_server_ciphers off;
	ssl_dhparam /etc/nginx/dhparam.pem;

So currently supported:

• ECDHE-ECDSA-AES128-GCM-SHA256
• ECDHE-RSA-AES128-GCM-SHA256
• ECDHE-ECDSA-AES256-GCM-SHA384
• ECDHE-RSA-AES256-GCM-SHA384
• ECDHE-ECDSA-CHACHA20-POLY1305
• ECDHE-RSA-CHACHA20-POLY1305
• DHE-RSA-AES128-GCM-SHA256
• DHE-RSA-AES256-GCM-SHA384

Update: The defined ssl_dhparam is not an FFDHE of RFC 7919. However it actually is FFDHE2048 .. but somehow the new sslyze internet.nl doesn't correctly recognizes it, since it's now insufficient according to the NCSC-NL TLS it's not reported, the old implementation does show it (https://internet.nl/site/desec.io/3753551/#control-panel-14)

DHE in general is not recommended, see https://datatracker.ietf.org/doc/html/rfc9325#appendix-A-2.2.2.9 (part of BCP 195). Note there is also a draft https://datatracker.ietf.org/doc/draft-ietf-tls-deprecate-obsolete-kex/08/ to completely deprecate DHE.

BTW since openssl 3 IANA cipher notation can be used (: (see our cipher config):

• TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
• TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
• TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
• TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
• TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
• TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256

In the NCSC-NL TLS recommendation DHE is already dropped, see an early demo implementation of it: https://dev4.internet.nl/site/desec.io/120/#control-panel-12

[Rotzbua]

Dropping DHE support would require ECDHE support. Browsers do have the support but routers?
Removing DHE would likly brick a lot setups. E.g. ECDHE support is enabled since v3 of mbedTLS from 2021.

Some statistics of the current usage would be useful before removing.

[peterthomassen]

Dropping DHE support would require ECDHE support. Browsers do have the support but routers? Removing DHE would likly brick a lot setups. E.g. ECDHE support is enabled since v3 of mbedTLS from 2021.

Some statistics of the current usage would be useful before removing.

I looked at last week's requests to our www container, and found:

Percentage	Algorithm
< 0.01	TLSv1.2/DHE-RSA-AES128-GCM-SHA256
0.01	TLSv1.2/DHE-RSA-AES256-GCM-SHA384
0.47	TLSv1.2/ECDHE-RSA-AES128-GCM-SHA256
1.49	TLSv1.3/TLS_CHACHA20_POLY1305_SHA256
1.88	TLSv1.2/ECDHE-RSA-AES256-GCM-SHA384
5.21	TLSv1.3/TLS_AES_128_GCM_SHA256
41.84	TLSv1.2/ECDHE-RSA-CHACHA20-POLY1305
49.08	TLSv1.3/TLS_AES_256_GCM_SHA384

... and filtered for update6?.dedyn.io or REST API requests (24.0% of the above):

Percentage	Algorithm
< 0.01	TLSv1.2/DHE-RSA-AES256-GCM-SHA384
0.55	TLSv1.2/ECDHE-RSA-CHACHA20-POLY1305
1.32	TLSv1.2/ECDHE-RSA-AES128-GCM-SHA256
3.46	TLSv1.2/ECDHE-RSA-AES256-GCM-SHA384
4.29	TLSv1.3/TLS_CHACHA20_POLY1305_SHA256
11.51	TLSv1.3/TLS_AES_128_GCM_SHA256
78.88	TLSv1.3/TLS_AES_256_GCM_SHA384

The DHE requests are from 3 users. We can certainly notify them manually. (Also, I'm surprised that 95% of dynDNS and API requests use TLS 1.3: I had expected more legacy deployments, especially for dynDNS.)

So, this would be a good change. Would you mind creating a pull request?

[Rotzbua]

@peterthomassen Is the current config deployed? Because DHE cipher seems still active?

[peterthomassen]

Is the current config deployed?

Yes, it's deployed (but only earlier today).

Because DHE cipher seems still active?

It looks like #1231 changed the cipher suite order, causing the server to insist on its preference order, with the old suites ranking low. (I misread the output in the below links; it continues to list the DHE ciphers, but now because they are deployed: it's just a static list for reference.

Did you misread the same way, did you think DHE suites are active because dhparam.pem was still there (#1250), or did you observe another indication of improper configuration?

For current results, compare https://internet.nl/site/desec.io/4252582/#control-panel-13 (now) and https://internet.nl/site/desec.io/3753551/#control-panel-13 (before).

[Rotzbua]

Yes, it's deployed (but only earlier today).

I tested yesterday 😄

Did you misread the same way, did you think DHE suites are active because dhparam.pem was still there (#1250), or did you observe another indication of improper configuration?

I was not sure, so I looked for any possible errors and found the orphaned file. Apart from that, I did not notice anything else.

Nice internet.nl test result 👍 :

Congratulations, your domain will be added to the Hall of Fame soon!