6

Perfect Forward Secrecy is an important enhancement to SSL/TLS communications, helping prevent captured SSL traffic from being decrypted even if the attacker has the private key. It's easy enough to support in web servers, but it's also applicable to any other SSL context, such as in mail servers for SMTP, POP3 and IMAP.

This has recently (Sept 2014) come to a head in Germany, where data protection bodies have started inspecting and fining organisations that do not support PFS on their mail servers, along with heartbleed and poodle vulnerabilities. PFS support in web browsers is somewhat patchy, though all the major ones support it - but I'm looking for PFS compatibility info on mail servers and clients, ideally something like SSL Labs' handshake tests provide, but for mail servers.

Can anyone provide or point me at good sources for mail server PFS compatibility?

To clarify, I'm not looking to interrogate a specific server, but to see the results of such testing across a wide range of different servers, for example it would be useful to know that Outlook 2003 doesn't support ECDHE, or that Android 2 doesn't allow DH params of bigger than 2048 bits (I don't know if these are true, they're just examples). The benefit of this is to know that if I choose to disable some specific cipher, which clients is it likely to affect, just like the SSL labs tests show for web clients.

4

The benefit of this is to know that if I choose to disable some specific cipher, which clients is it likely to affect, just like the SSL labs tests show for web clients.

You don't need to restrict yourself to a specific cipher, but instead simply enable all ciphers which are acceptable to you and in the order you prefer them. The resulting cipher then will be negotiated between client and server depending on the supported ciphers on both sites. Don't restrict yourself unnecessary.

As for the ciphers typically used at the server side you might have a look at Quantifying the quality of TLS support where I've analyzed the TLS support for SMTP from the top 1M sites according to Alexa, which are about 600000 mail server with TLS enabled. According to my tests about 33% of the servers use ECDHE ciphers and 52% DHE ciphers, so that 85% use forward secrecy.

And for some more information about the ciphers used you will not find in the study here is a detailed list of ciphers negotiated when used with the DEFAULT cipher set of OpenSSL 1.0.1:

100.00%     600433 TOTAL
 29.53%     177285 DHE-RSA-AES256-GCM-SHA384
 21.20%     127304 ECDHE-RSA-AES128-GCM-SHA256
 20.62%     123804 DHE-RSA-AES256-SHA
  7.65%      45919 AES256-SHA
  6.40%      38404 ECDHE-RSA-AES256-GCM-SHA384
  4.42%      26558 AES256-GCM-SHA384
  4.36%      26189 ECDHE-RSA-AES256-SHA384
  1.76%      10586 AES128-SHA
  1.17%       7003 RC4-SHA
  0.93%       5577 DHE-RSA-AES256-SHA256
  0.90%       5389 ECDHE-RSA-AES256-SHA
  0.56%       3372 DHE-RSA-CAMELLIA256-SHA
  0.19%       1137 RC4-MD5
  0.08%        503 EDH-RSA-DES-CBC3-SHA
  0.08%        454 DES-CBC3-SHA
  0.07%        444 AES128-SHA256
  0.04%        235 DHE-RSA-AES128-GCM-SHA256
  0.01%         82 AES128-GCM-SHA256
  0.01%         59 AES256-SHA256
  0.01%         53 DHE-RSA-AES128-SHA
  0.00%         23 ECDHE-RSA-AES128-SHA
  0.00%         14 DHE-DSS-AES256-SHA
  0.00%         11 ECDHE-RSA-AES128-SHA256
  0.00%         10 ECDHE-RSA-RC4-SHA
  0.00%         10 ECDHE-RSA-DES-CBC3-SHA
  0.00%          4 DHE-DSS-AES256-GCM-SHA384
  0.00%          2 CAMELLIA256-SHA
  0.00%          1 DHE-RSA-SEED-SHA
  0.00%          1 AECDH-DES-CBC3-SHA
2
  • Great stats, nice article too, thanks! The "Don't restrict yourself unnecessarily" is the problem - just as with browsers, you can't just disable everything that's considered bad because you might find that you've cut off something critical, but it's hard to tell what that something is. For the German legal example, requiring PFS would mean cutting off 15% of the 60% of servers that support TLS. One key stat from your article is that SSLv3 be disabled without any major deliverability impact. – Synchro Dec 30 '14 at 18:36
  • @Synchro: You can support both PFS and non-PFS servers at the same time by including both cipher sets. Just put the PFS ciphers first. – Steffen Ullrich Dec 30 '14 at 18:44
3

Please check the free script written by the firm where one of the highly qualified folks at Security SE works: https://labs.portcullis.co.uk/tools/ssl-cipher-suite-enum/

ssl-cipher-suite-enum identifies the following common security issues relating to SSL: ...Support of key exchange algorithms that don’t support forward secrecy – or equivalently, cipher suites that allow sniffed traffic to be retrospectively decrypted if the private SSL key were to be compromised.

If you want to do it slowly and by hand, openssl portmanteau toolset is very handy:

From https://community.qualys.com/thread/12193:

openssl s_client -starttls smtp -crlf -connect YOUR_SMTP_SERVER:25

If you see DHE (Diffie-Hellmann Ephemeral) in the cipher suite, it's PFS.

From this post at Security SE TLS_DHE_DSS_WITH_DES_CBC_SHA DHE-DSS-CBC-SHA TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA DHE-DSS-DES-CBC3-SHA TLS_DHE_RSA_WITH_DES_CBC_SHA DHE-RSA-DES-CBC-SHA TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA DHE-RSA-DES-CBC3-SHA

TLS_DHE_DSS_WITH_AES_128_CBC_SHA        DHE-DSS-AES128-SHA
TLS_DHE_DSS_WITH_AES_256_CBC_SHA        DHE-DSS-AES256-SHA
TLS_DHE_RSA_WITH_AES_128_CBC_SHA        DHE-RSA-AES128-SHA
TLS_DHE_RSA_WITH_AES_256_CBC_SHA        DHE-RSA-AES256-SHA

TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA  DHE-DSS-CAMELLIA128-SHA
TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA  DHE-DSS-CAMELLIA256-SHA
TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA  DHE-RSA-CAMELLIA128-SHA
TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA  DHE-RSA-CAMELLIA256-SHA

TLS_DHE_DSS_WITH_SEED_CBC_SHA          DHE-DSS-SEED-SHA
TLS_DHE_RSA_WITH_SEED_CBC_SHA          DHE-RSA-SEED-SHA

If we include the Elliptic Curve ciphers, the following also implement PFS:

TLS_ECDHE_RSA_WITH_NULL_SHA             ECDHE-RSA-NULL-SHA
TLS_ECDHE_RSA_WITH_RC4_128_SHA          ECDHE-RSA-RC4-SHA
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA     ECDHE-RSA-DES-CBC3-SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA      ECDHE-RSA-AES128-SHA
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA      ECDHE-RSA-AES256-SHA

TLS_ECDHE_ECDSA_WITH_NULL_SHA           ECDHE-ECDSA-NULL-SHA
TLS_ECDHE_ECDSA_WITH_RC4_128_SHA        ECDHE-ECDSA-RC4-SHA
TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA   ECDHE-ECDSA-DES-CBC3-SHA
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA    ECDHE-ECDSA-AES128-SHA
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA    ECDHE-ECDSA-AES256-SHA

If you also want to include TLS 1.2 (note that there are no TLS 1.1 specific suites) then you can expand the list to include:

TLS_DHE_RSA_WITH_AES_128_CBC_SHA256       DHE-RSA-AES128-SHA256
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256       DHE-RSA-AES256-SHA256
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256       DHE-RSA-AES128-GCM-SHA256
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384       DHE-RSA-AES256-GCM-SHA384

TLS_DHE_DSS_WITH_AES_128_CBC_SHA256       DHE-DSS-AES128-SHA256
TLS_DHE_DSS_WITH_AES_256_CBC_SHA256       DHE-DSS-AES256-SHA256
TLS_DHE_DSS_WITH_AES_128_GCM_SHA256       DHE-DSS-AES128-GCM-SHA256
TLS_DHE_DSS_WITH_AES_256_GCM_SHA384       DHE-DSS-AES256-GCM-SHA384

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256     ECDHE-RSA-AES128-SHA256
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384     ECDHE-RSA-AES256-SHA384
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256     ECDHE-RSA-AES128-GCM-SHA256
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384     ECDHE-RSA-AES256-GCM-SHA384

TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256   ECDHE-ECDSA-AES128-SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384   ECDHE-ECDSA-AES256-SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256   ECDHE-ECDSA-AES128-GCM-SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384   ECDHE-ECDSA-AES256-GCM-SHA384

TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 ECDHE-ECDSA-CAMELLIA128-SHA256
TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 ECDHE-ECDSA-CAMELLIA256-SHA384

TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256   ECDHE-RSA-CAMELLIA128-SHA256
TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384   ECDHE-RSA-CAMELLIA256-SHA384
7
  • That's useful info, but it's sort of the wrong way around. I'm not looking to interrogate a specific server, but to assess support for all these ciphers across many different servers and clients, i.e. find someone that has applied these tests to a large number of different servers. – Synchro Dec 19 '14 at 10:45
  • @Synchro - your question should be edited to reflect what you mean. As it stands now, it asks for Qualys handshake tests applied to mail. – Deer Hunter Dec 19 '14 at 10:48
  • @Synchro - it's also a matter of configuration. – Deer Hunter Dec 19 '14 at 10:54
  • 1
  • I know it is in servers, but it's generally not in clients, and it's still interesting to know for default server configs since that's what most will be using. – Synchro Dec 19 '14 at 10:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.