Update SHA2 key exchange check to new requirements (must reject SHA1 and older, sha224 to phase out).

Note labels have changed slightly.

Author: mxsasha

checks/categories.py

@@ -1488,18 +1488,23 @@ def __init__(self):
     def result_good(self):
         self._status(STATUS_SUCCESS)
         self.verdict = "detail web tls kex-hash-func verdict good"
-        self.tech_data = "detail tech data yes"
+        self.tech_data = "detail tech data good"
 
     def result_bad(self):
         self._status(STATUS_FAIL)
-        self.verdict = "detail web tls kex-hash-func verdict phase-out"
-        self.tech_data = "detail tech data no"
+        self.verdict = "detail web tls kex-hash-func verdict bad"
+        self.tech_data = "detail tech data insufficient"
 
     def result_unknown(self):
         self._status(STATUS_INFO)
         self.verdict = "detail web tls kex-hash-func verdict other"
         self.tech_data = "detail tech data not-applicable"
 
+    def result_phase_out(self):
+        self._status(STATUS_NOTICE)
+        self.verdict = "detail web tls kex-hash-func verdict phase-out"
+        self.tech_data = "detail tech data phase-out"
+
 
 class MailTlsStarttlsExists(Subtest):
     def __init__(self):
@@ -2072,6 +2077,11 @@ def result_unknown(self):
         self.verdict = "detail mail tls kex-hash-func verdict other"
         self.tech_data = "detail tech data not-applicable"
 
+    def result_phase_out(self):
+        self._status(STATUS_NOTICE)
+        self.verdict = "detail web tls kex-hash-func verdict phase-out"
+        self.tech_data = "detail tech data phase-out"
+
 
 class MailTlsDaneExists(Subtest):
     def __init__(self):

checks/models.py

@@ -99,6 +99,7 @@ class KexHashFuncStatus(Enum):
     bad = 0
     good = 1
     unknown = 2
+    phase_out = 3
 
 
 class CipherOrderStatus(Enum):

checks/tasks/tls/scans.py

@@ -19,6 +19,7 @@
 from dns.name import EmptyLabel
 from dns.resolver import NXDOMAIN, NoAnswer, NoNameservers, LifetimeTimeout
 from nassl._nassl import OpenSSLError
+from nassl.ephemeral_key_info import OpenSslEvpPkeyEnum
 from nassl.ssl_client import ClientCertificateRequested, OpenSslDigestNidEnum
 from sslyze import (
     ScanCommand,
@@ -78,8 +79,9 @@
     CERT_CURVE_MIN_KEY_SIZE,
     CERT_EC_CURVES_GOOD,
     CERT_EC_CURVES_PHASE_OUT,
-    SIGNATURE_ALGORITHMS_SHA2,
     MAIL_ALTERNATE_CONNLIMIT_HOST_SUBSTRS,
+    SIGNATURE_ALGORITHMS_BAD_HASH,
+    SIGNATURE_ALGORITHMS_PHASE_OUT_HASH,
 )
 from internetnl import log
 
@@ -611,6 +613,14 @@ def check_mail_tls(result: ServerScanResult, all_suites: List[CipherSuitesScanAt
     )
     cert_results = cert_checks(result.server_location.hostname, ChecksMode.MAIL)
 
+    key_exchange_hash_evaluation = test_key_exchange_hash(
+        ServerConnectivityInfo(
+            server_location=result.server_location,
+            network_configuration=result.network_configuration,
+            tls_probing_result=result.connectivity_result,
+        ),
+    )
+
     # HACK for DANE-TA(2) and hostname mismatch!
     # Give a good hosmatch score if DANE-TA *is not* present.
     if cert_results["tls_cert"] and not has_daneTA(cert_results["dane_records"]) and cert_results["hostmatch_bad"]:
@@ -665,8 +675,8 @@ def check_mail_tls(result: ServerScanResult, all_suites: List[CipherSuitesScanAt
             if result.scan_result.tls_1_3_early_data.result.supports_early_data
             else scoring.WEB_TLS_ZERO_RTT_GOOD
         ),
-        kex_hash_func=KexHashFuncStatus.good,
-        kex_hash_func_score=scoring.WEB_TLS_KEX_HASH_FUNC_OK,
+        kex_hash_func=key_exchange_hash_evaluation.status,
+        kex_hash_func_score=key_exchange_hash_evaluation.score,
     )
     results.update(cert_results)
     return results
@@ -855,38 +865,59 @@ def test_key_exchange_hash(
     server_connectivity_info: ServerConnectivityInfo,
 ) -> KeyExchangeHashFunctionEvaluation:
     """
-    Test the SHA2 key exchange per NCSC table 5.
+    Test key exchange hashes per NCSC 3.3.5.
     Note that this is not the certificate hash, or TLS cipher hash.
     There are few or no hosts that do not meet this requirement.
     """
-    ssl_connection = server_connectivity_info.get_preconfigured_tls_connection(should_use_legacy_openssl=False)
-    ssl_connection.ssl_client.set_sigalgs(SIGNATURE_ALGORITHMS_SHA2)
-
-    try:
-        ssl_connection.connect()
-        if ssl_connection.ssl_client.get_peer_signature_nid() == OpenSslDigestNidEnum.SHA1:
-            log.info("Failed SHA2 key exchange check: negotiated SHA1 even when only offering SHA2")
-            return KeyExchangeHashFunctionEvaluation(
-                status=KexHashFuncStatus.bad,
-                score=scoring.WEB_TLS_KEX_HASH_FUNC_BAD,
-            )
-    except ClientCertificateRequested:
-        pass
-    except (ServerRejectedTlsHandshake, TlsHandshakeTimedOut, OpenSSLError) as exc:
-        log.info(f"Failed SHA2 key exchange check: {exc}")
+    bad_hash_result = _test_connection_with_limited_sigalgs(server_connectivity_info, SIGNATURE_ALGORITHMS_BAD_HASH)
+    if bad_hash_result:
+        log.info(f"SHA2 key exchange check: negotiated bad hash ({bad_hash_result})")
         return KeyExchangeHashFunctionEvaluation(
             status=KexHashFuncStatus.bad,
             score=scoring.WEB_TLS_KEX_HASH_FUNC_BAD,
         )
-    finally:
-        ssl_connection.close()
+
+    phase_out_hash_result = _test_connection_with_limited_sigalgs(
+        server_connectivity_info, SIGNATURE_ALGORITHMS_PHASE_OUT_HASH
+    )
+    if bad_hash_result:
+        log.info(f"SHA2 key exchange check: negotiated phase_out hash ({bad_hash_result})")
+        return KeyExchangeHashFunctionEvaluation(
+            status=KexHashFuncStatus.phase_out,
+            score=scoring.WEB_TLS_KEX_HASH_FUNC_OK,
+        )
 
     return KeyExchangeHashFunctionEvaluation(
         status=KexHashFuncStatus.good,
         score=scoring.WEB_TLS_KEX_HASH_FUNC_GOOD,
     )
 
 
+def _test_connection_with_limited_sigalgs(
+    server_connectivity_info: ServerConnectivityInfo, sigalgs: list[tuple[OpenSslDigestNidEnum, OpenSslEvpPkeyEnum]]
+) -> Optional[tuple[OpenSslDigestNidEnum, OpenSslEvpPkeyEnum]]:
+    """
+    Test whether the server accepts a connection with limited sigalgs through the signature_algorithms extension.
+    Returns a (NID, EVP PKEY) if a match was found, None otherwise.
+    """
+    ssl_connection = server_connectivity_info.get_preconfigured_tls_connection(should_use_legacy_openssl=False)
+    ssl_connection.ssl_client.set_sigalgs(SIGNATURE_ALGORITHMS_BAD_HASH)
+
+    try:
+        ssl_connection.connect()
+        sigalg_nid = ssl_connection.ssl_client.get_peer_signature_nid()
+        # Extra check as some servers will ignore the client, and force a secure hash anyways.
+        # OpenSSL will accept this, as it does know about the secure hash.
+        if sigalg_nid in sigalgs:
+            return sigalg_nid
+    except (ClientCertificateRequested, ServerRejectedTlsHandshake, TlsHandshakeTimedOut, OpenSSLError) as exc:
+        pass
+    finally:
+        ssl_connection.close()
+
+    return None
+
+
 def test_cipher_order(
     server_connectivity_info: ServerConnectivityInfo,
     tls_versions: List[TlsVersionEnum],

checks/tasks/tls/tasks_reports.py

@@ -570,6 +570,8 @@ def annotate_and_combine_all(good_items, sufficient_items, bad_items, phaseout_i
                 category.subtests["kex_hash_func"].result_bad()
             elif dttls.kex_hash_func == KexHashFuncStatus.unknown:
                 category.subtests["kex_hash_func"].result_unknown()
+            elif dttls.kex_hash_func == KexHashFuncStatus.phase_out:
+                category.subtests["kex_hash_func"].result_phase_out()
 
     elif isinstance(category, categories.MailTls):
         if dttls.could_not_test_smtp_starttls:
@@ -730,6 +732,8 @@ def annotate_and_combine_all(good_items, sufficient_items, bad_items, phaseout_i
                 category.subtests["kex_hash_func"].result_bad()
             elif dttls.kex_hash_func == KexHashFuncStatus.unknown:
                 category.subtests["kex_hash_func"].result_unknown()
+            elif dttls.kex_hash_func == KexHashFuncStatus.phase_out:
+                category.subtests["kex_hash_func"].result_phase_out()
 
     dttls.report = category.gen_report()
 

checks/tasks/tls/tls_constants.py

@@ -115,22 +115,34 @@
 ]
 PROTOCOLS_PHASE_OUT = []
 
-# NCSC table 5
-# This is eventually passed to openssl's SSL_set1_sigalgs,
+# These are eventually passed to openssl's SSL_set1_sigalgs,
 # which requires the NIDs in digest+pubkey algorithm tuples.
-SIGNATURE_ALGORITHMS_SHA2 = [
-    (OpenSslDigestNidEnum.SHA512, OpenSslEvpPkeyEnum.EC),
-    (OpenSslDigestNidEnum.SHA384, OpenSslEvpPkeyEnum.EC),
-    (OpenSslDigestNidEnum.SHA256, OpenSslEvpPkeyEnum.EC),
+# NCSC 3.3.5, connection with this set means bad hashes are enabled
+SIGNATURE_ALGORITHMS_BAD_HASH = [
+    (OpenSslDigestNidEnum.MD5, OpenSslEvpPkeyEnum.EC),
+    (OpenSslDigestNidEnum.SHA1, OpenSslEvpPkeyEnum.EC),
+    (OpenSslDigestNidEnum.MD5, OpenSslEvpPkeyEnum.RSA),
+    (OpenSslDigestNidEnum.SHA1, OpenSslEvpPkeyEnum.RSA),
+    (OpenSslDigestNidEnum.MD5, OpenSslEvpPkeyEnum.RSA_PSS),
+    (OpenSslDigestNidEnum.SHA1, OpenSslEvpPkeyEnum.RSA_PSS),
+    (OpenSslDigestNidEnum.MD5, OpenSslEvpPkeyEnum.DSA),
+    (OpenSslDigestNidEnum.SHA1, OpenSslEvpPkeyEnum.DSA),
+]
+SIGNATURE_ALGORITHMS_PHASE_OUT_HASH = [
+    (OpenSslDigestNidEnum.SHA224, OpenSslEvpPkeyEnum.EC),
+    (OpenSslDigestNidEnum.SHA224, OpenSslEvpPkeyEnum.RSA),
+    (OpenSslDigestNidEnum.SHA224, OpenSslEvpPkeyEnum.RSA_PSS),
+    (OpenSslDigestNidEnum.SHA224, OpenSslEvpPkeyEnum.DSA),
+]
+# NCSC 3.3.2.1: RSA PKCS must not be used.
+# Failing these algs means the server has no RSA or RSA in PSS only, either is fine.
+SIGNATURE_ALGORITHMS_RSA_PKCS = [
+    (OpenSslDigestNidEnum.MD5, OpenSslEvpPkeyEnum.RSA),
+    (OpenSslDigestNidEnum.SHA1, OpenSslEvpPkeyEnum.RSA),
+    (OpenSslDigestNidEnum.SHA224, OpenSslEvpPkeyEnum.RSA),
     (OpenSslDigestNidEnum.SHA512, OpenSslEvpPkeyEnum.RSA),
     (OpenSslDigestNidEnum.SHA384, OpenSslEvpPkeyEnum.RSA),
     (OpenSslDigestNidEnum.SHA256, OpenSslEvpPkeyEnum.RSA),
-    (OpenSslDigestNidEnum.SHA512, OpenSslEvpPkeyEnum.RSA_PSS),
-    (OpenSslDigestNidEnum.SHA384, OpenSslEvpPkeyEnum.RSA_PSS),
-    (OpenSslDigestNidEnum.SHA256, OpenSslEvpPkeyEnum.RSA_PSS),
-    (OpenSslDigestNidEnum.SHA512, OpenSslEvpPkeyEnum.DSA),
-    (OpenSslDigestNidEnum.SHA384, OpenSslEvpPkeyEnum.DSA),
-    (OpenSslDigestNidEnum.SHA256, OpenSslEvpPkeyEnum.DSA),
 ]
 
 # Mail servers with an increased connection limit,