From owner-freebsd-security@freebsd.org Sun Jul 29 00:16:59 2018 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 0FD0A106297C for ; Sun, 29 Jul 2018 00:16:59 +0000 (UTC) (envelope-from dewayne.geraghty@heuristicsystems.com.au) Received: from hermes.heuristicsystems.com.au (hermes.heuristicsystems.com.au [203.41.22.115]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "hermes.heuristicsystems.com.au", Issuer "Heuristic Systems Type 4 Host CA" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id DBACF86F9B for ; Sun, 29 Jul 2018 00:16:56 +0000 (UTC) (envelope-from dewayne.geraghty@heuristicsystems.com.au) Received: from [10.0.5.3] (noddy.hs [10.0.5.3]) (authenticated bits=0) by hermes.heuristicsystems.com.au (8.15.2/8.15.2) with ESMTPSA id w6SNxUOC031958 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT); Sun, 29 Jul 2018 09:59:41 +1000 (AEST) (envelope-from dewayne.geraghty@heuristicsystems.com.au) X-Authentication-Warning: b3.hs: Host noddy.hs [10.0.5.3] claimed to be [10.0.5.3] Subject: Re: TLSv1.3 support in freeBSD 11.X To: "PRAKASH RAI (prakrai)" References: <2ECA83EC-B156-43DF-AFDD-407BDFF74DAA@contoso.com> From: Dewayne Geraghty Cc: "freebsd-security@freebsd.org" Message-ID: <81dc7784-62d2-37e8-95f0-1f49215d4a58@heuristicsystems.com.au> Date: Sun, 29 Jul 2018 09:59:29 +1000 User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:52.0) Gecko/20100101 Thunderbird/52.8.0 MIME-Version: 1.0 In-Reply-To: <2ECA83EC-B156-43DF-AFDD-407BDFF74DAA@contoso.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Content-Language: en-AU X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 29 Jul 2018 00:16:59 -0000 On 26/07/2018 9:45 PM, PRAKASH RAI (prakrai) via freebsd-security wrote: > Hi All, > > I was going through the https://wiki.freebsd.org/OpenSSL and found that openssl 1.1.1 support is planned for freeBSD 12. > As TLSv1.3 is based on openssl 1.1.1, does it mean that freeBSD 11.X would not be having support for TLSv1.3? > > Basically I would like to understand if I can build openssl 1.1.1 (which is having support for TLSv1.3) with FreeBSD 11.2 without any issue and enable TLSv1.3 support? > > Regards, > Prakash > Prakash, You're very ambitious ;)  TLSv1.3 is very different from 1.2 and others.  Additional ciphers are "nice", but the session controls are quite different and will take a while for applications to settle into.  Quite a few applications are not yet at openssl 1.1.0, so surprise yourself and try something like: for interests in security www; do find /usr/ports/$interests/ -name Makefile|xargs grep openssl-devel|grep BROKEN; done And you should also note that the ports are only built on lowest supported FreeBSD (#1), and on the 11 stream, that seems to be FreeBSD 11.1Release; so we should really work in unison to migrate to openssl 1.1.1 :)  Drawn your own conclusions about what ports have been tested on 11.2Release FYI perhaps consider libressl which has some additional/useful ciphers, might be worth a look if the ciphers are your driver.  Ref: #1 Poke around here:  http://beefy9.nyi.freebsd.org/data/latest-per-pkg/ Cheers.