Last Modified: Oct 16, 2023
Affected Product(s):
BIG-IP TMOS
Known Affected Versions:
11.4.1, 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.5.5, 11.5.6, 11.5.7, 11.5.8, 11.5.9, 11.5.10, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.6.3.1, 12.1.0 HF1, 12.1.0 HF2, 12.1.1 HF1, 12.1.1 HF2, 12.1.2 HF1, 12.1.2 HF2
Fixed In:
12.0.0, 11.6.3.2
Opened: Apr 08, 2015 Severity: 4-Minor Related Article:
K40424522
Applications including Microsoft Internet Explorer (IE) using the Microsoft Secure Channel ('Schannel') TLS library may experience TLS handshake failures while accessing virtual servers with Client SSL profiles. When the client and server select a TLS ciphersuite that utilizes ephemeral Diffie-Hellman (DHE) key exchange, the server (the BIG-IP system) sends a ServerKeyExchange message with Diffie-Hellman parameters to the client. For a subset of the generated parameters (approximately 1 in 128 for 1024-bit DH parameters), the length of the encoded 'dh_Ys' parameter is less than the length of the encoded 'dh_P' parameter. As a result of that encoding combined with an issue with the Schannel library, the client experiences a fatal error and is unable to complete the TLS handshake. When this issue occurs, only a subset (potentially only one) TMM may experience handshake failures, because each TMM generates unique DH parameters. Handshake failures may last for up to an hour, as each TMM regenerates parameters every hour.
Schannel-based applications may be unable to complete TLS handshakes with one more TMMs on a system for up to an hour. Other clients are unaffected, and can successfully complete TLS handshakes.
- Virtual servers with Client SSL profiles. - Client applications using the Secure Channel (Schannel) TLS library. Relevant clients include IE. - The BIG-IP system selects a ciphersuite that uses DHE key exchange. Note that the ECDHE key exchange is unaffected.
Disable DHE cipher suites in client-ssl profiles, as follows: * 'DEFAULT:!EDH' to permanently remove DH-based ciphersuites. * 'DEFAULT:-EDH:DEFAULT+EDH' to move them to the end of the preference list.
In order to avoid this issue, the BIG-IP ensures that the encoded Diffie-Hellman parameters ('dh_p' and 'dh_Ys') in TLS ServerKeyExchange are always the same length by padding 'dh_Ys' with leading 0x00 bytes.