Bug ID 517202: Applications including Internet Explorer using Microsoft's Secure Channel (Schannel) may fail SSL/TLS handshakes

Last Modified: Nov 07, 2022

Bug Tracker

Affected Product:  See more info
BIG-IP TMOS(all modules)

Known Affected Versions:
11.4.1, 11.5.0, 11.5.1, 11.5.1 HF1, 11.5.1 HF10, 11.5.1 HF11, 11.5.1 HF2, 11.5.1 HF3, 11.5.1 HF4, 11.5.1 HF5, 11.5.1 HF6, 11.5.1 HF7, 11.5.1 HF8, 11.5.1 HF9, 11.5.10, 11.5.2, 11.5.2 HF1, 11.5.3, 11.5.3 HF1, 11.5.3 HF2, 11.5.4, 11.5.4 HF1, 11.5.4 HF2, 11.5.4 HF3, 11.5.4 HF4, 11.5.5, 11.5.6, 11.5.7, 11.5.8, 11.5.9, 11.6.0, 11.6.0 HF1, 11.6.0 HF2, 11.6.0 HF3, 11.6.0 HF4, 11.6.0 HF5, 11.6.0 HF6, 11.6.0 HF7, 11.6.0 HF8, 11.6.1, 11.6.1 HF1, 11.6.1 HF2, 11.6.2, 11.6.2 HF1, 11.6.3, 11.6.3.1

Fixed In:
12.0.0, 11.6.3.2

Opened: Apr 08, 2015
Severity: 4-Minor
Related Article:
K40424522

Symptoms

Applications including Microsoft Internet Explorer (IE) using the Microsoft Secure Channel ('Schannel') TLS library may experience TLS handshake failures while accessing virtual servers with Client SSL profiles. When the client and server select a TLS ciphersuite that utilizes ephemeral Diffie-Hellman (DHE) key exchange, the server (the BIG-IP system) sends a ServerKeyExchange message with Diffie-Hellman parameters to the client. For a subset of the generated parameters (approximately 1 in 128 for 1024-bit DH parameters), the length of the encoded 'dh_Ys' parameter is less than the length of the encoded 'dh_P' parameter. As a result of that encoding combined with an issue with the Schannel library, the client experiences a fatal error and is unable to complete the TLS handshake. When this issue occurs, only a subset (potentially only one) TMM may experience handshake failures, because each TMM generates unique DH parameters. Handshake failures may last for up to an hour, as each TMM regenerates parameters every hour.

Impact

Schannel-based applications may be unable to complete TLS handshakes with one more TMMs on a system for up to an hour. Other clients are unaffected, and can successfully complete TLS handshakes.

Conditions

- Virtual servers with Client SSL profiles. - Client applications using the Secure Channel (Schannel) TLS library. Relevant clients include IE. - The BIG-IP system selects a ciphersuite that uses DHE key exchange. Note that the ECDHE key exchange is unaffected.

Workaround

Disable DHE cipher suites in client-ssl profiles, as follows: * 'DEFAULT:!EDH' to permanently remove DH-based ciphersuites. * 'DEFAULT:-EDH:DEFAULT+EDH' to move them to the end of the preference list.

Fix Information

In order to avoid this issue, the BIG-IP ensures that the encoded Diffie-Hellman parameters ('dh_p' and 'dh_Ys') in TLS ServerKeyExchange are always the same length by padding 'dh_Ys' with leading 0x00 bytes.

Behavior Change