Enabling RC4 from command line tools in OpenSSL 3.1

[Ladd, Watson]

Dear users,

I have been struggling to sort out what compile flags and arguments are required to get s_client from OpenSSL 3.1.7 to connect to a server with only RC4 enabled. I thought ./Configure enable-rc4 enable-weak-ssl-ciphers would be enough, and then  ./openssl s_client -tls1 -cipher RC4. However this results in 

Call to SSL_CONF_cmd(-cipher, RC4) failed

004CA1EE01000000:error:0A0000B9:SSL routines:SSL_CTX_set_cipher_list:no cipher match:ssl/ssl_lib.c:2909

which surprises me.

What am I missing?

Sincerely,

Watson Ladd

[Ladd, Watson]

That was a very good idea, but sadly still doesn't work

DYLD_LIBRARY_PATH=`cd .. && pwd` ./openssl s_client -tls1 -cipher RC4  -provider-path /Users/wladd/code/openssl/providers/ -provider legacy

004CA1EE01000000:error:0A0000A1:SSL routines:SSL_CTX_new_ex:library has no ciphers:ssl/ssl_lib.c:3474

Suspect something went awry in configuring compiling that.

---

From: Dmitry Belyavsky <bel...@gmail.com>
Sent: Friday, September 6, 2024 11:25:46 AM
To: Ladd, Watson
Cc: openss...@openssl.org
Subject: Re: Enabling RC4 from command line tools in OpenSSL 3.1

 

!-------------------------------------------------------------------|
  This Message Is From an Untrusted Sender
  You have not previously corresponded with this sender.
|-------------------------------------------------------------------!

I think you should load the legacy provider. The default provider
doesn't implement RC4.

> --
> You received this message because you are subscribed to the Google Groups "openssl-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to openssl-user...@openssl.org.
> To view this discussion on the web visit https://urldefense.com/v3/__https://groups.google.com/a/openssl.org/d/msgid/openssl-users/1ee7e3f49d3f45d8a303722cd4967c16*40akamai.com__;JQ!!GjvTz_vk!R5hKSU2uh2SDcVexUNOyYLTwaFFhgNo5xij19sbloiZEuvEJIUlJNcd609a4vU0Yr17jVeRbK5fB$ .



--
SY, Dmitry Belyavsky

[Viktor Dukhovni]

On Fri, Sep 06, 2024 at 06:56:41PM +0000, 'Ladd, Watson' via openssl-users wrote:
>
> That was a very good idea, but sadly still doesn't work
>
>
> DYLD_LIBRARY_PATH=`cd .. && pwd` ./openssl s_client -tls1 -cipher RC4 -provider-path /Users/wladd/code/openssl/providers/ -provider legacy
>
> 004CA1EE01000000:error:0A0000A1:SSL routines:SSL_CTX_new_ex:library has no ciphers:ssl/ssl_lib.c:3474
>
>
> Suspect something went awry in configuring compiling that.

You still need the default provider for the KEX and MAC algorithms, ...

$ ./util/wrap.pl ./apps/openssl ciphers -tls1_2 -s -v -provider legacy RC4:@SECLEVEL=0
80BBAB49927F0000:error:0A0000A1:SSL routines:SSL_CTX_new_ex:library has no ciphers:ssl/ssl_lib.c:3977:

$ ./util/wrap.pl ./apps/openssl ciphers -tls1_2 -s -v -provider default -provider legacy RC4:@SECLEVEL=0
ECDHE-ECDSA-RC4-SHA TLSv1 Kx=ECDH Au=ECDSA Enc=RC4(128) Mac=SHA1
ECDHE-RSA-RC4-SHA TLSv1 Kx=ECDH Au=RSA Enc=RC4(128) Mac=SHA1
AECDH-RC4-SHA TLSv1 Kx=ECDH Au=None Enc=RC4(128) Mac=SHA1
ADH-RC4-MD5 SSLv3 Kx=DH Au=None Enc=RC4(128) Mac=MD5
RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1
RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5

--
Viktor.

[Ladd, Watson]

A coworker suggested that earlier, still no luck. Has anyone gotten this to work?

---

From: Dmitry Belyavsky <bel...@gmail.com>
Sent: Friday, September 6, 2024 12:00:02 PM

To: Ladd, Watson
Cc: openss...@openssl.org
Subject: Re: Enabling RC4 from command line tools in OpenSSL 3.1

!-------------------------------------------------------------------|
  This Message Is From an Untrusted Sender
  You have not previously corresponded with this sender.
|-------------------------------------------------------------------!

SECLEVEL=0?

--
SY, Dmitry Belyavsky

[Ladd, Watson]

Thank you that worked.

---

From: openss...@openssl.org <openss...@openssl.org> on behalf of Viktor Dukhovni <openss...@dukhovni.org>
Sent: Friday, September 6, 2024 12:39:54 PM
To: openss...@openssl.org

Subject: Re: Enabling RC4 from command line tools in OpenSSL 3.1

 

!-------------------------------------------------------------------|
  This Message Is From an External Sender
  This message came from outside your organization.
|-------------------------------------------------------------------!

--
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-user...@openssl.org.

To view this discussion on the web visit https://urldefense.com/v3/__https://groups.google.com/a/openssl.org/d/msgid/openssl-users/ZttaikEHT8_RMcN6*40chardros.imrryr.org__;JQ!!GjvTz_vk!RdBT-UozixIVLcoSPJluewa7IGgy7ihRVlkaAG7c1bJq0uZ1uyxx34QjeyupX0FchvekBtral09kFYVsakicW7Qn$ .

[Dmitry Belyavsky]

SECLEVEL=0?

On Fri, Sep 6, 2024 at 8:56 PM Ladd, Watson <wl...@akamai.com> wrote:
>
>

--
SY, Dmitry Belyavsky

[Dmitry Belyavsky]

I think you should load the legacy provider. The default provider
doesn't implement RC4.

On Fri, Sep 6, 2024 at 8:04 PM 'Ladd, Watson' via openssl-users
<openss...@openssl.org> wrote:
>

> --
> You received this message because you are subscribed to the Google Groups "openssl-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to openssl-user...@openssl.org.

> To view this discussion on the web visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/1ee7e3f49d3f45d8a303722cd4967c16%40akamai.com.



--
SY, Dmitry Belyavsky