Runtime: How can I use TlsCipherSuite.TLS_RSA_WITH_DES_CBC_SHA in Sslsteam

[Jackcu]

Scenario

There are old server that use TLS for data transmission and work with weak TlsCipherSuite:TLS_RSA_WITH_DES_CBC_SHA and accept TLS_RSA_WITH_DES_CBC_SHA only. I have to send TLS_RSA_WITH_DES_CBC_SHA on "Hello client"

OS: macOS, windows

What I want

My code

I have tried following code with reflect,it's not work and throw a exception

_ssls = new SslStream(_ns, false, ValidateServerCertificate, null);

var method_AuthenticateAsClient = typeof(SslStream).GetMethods(BindingFlags.NonPublic | BindingFlags.Instance)
                                                   .ToList()
                                                   .Where(v => v.Name == "AuthenticateAsClient")
                                                   .First();
var tlsCipherSuites = new List<TlsCipherSuite>() {TlsCipherSuite.TLS_RSA_WITH_DES_CBC_SHA};
var policy          = new CipherSuitesPolicy(tlsCipherSuites);
var opt = new SslClientAuthenticationOptions() {
    TargetHost                     = "test1"
  , ClientCertificates             = null
  , EnabledSslProtocols            = SslProtocols.Tls
  , CertificateRevocationCheckMode = X509RevocationMode.NoCheck
  , EncryptionPolicy               = EncryptionPolicy.RequireEncryption
  , CipherSuitesPolicy             = policy
};

method_AuthenticateAsClient.Invoke(_ssls, new[] {opt});

Exception has been thrown by the target of an invocation. ---> System.Security.Authentication.AuthenticationException: Authentication failed, see inner exception. ---> Interop+AppleCrypto+SslException: One or more parameters passed to a function were not valid.
  at at System.Net.SafeDeleteSslContext..ctor(SafeFreeSslCredentials credential, SslAuthenticationOptions sslAuthenticationOptions)
  at at System.Net.Security.SslStreamPal.HandshakeInternal(SafeFreeCredentials credential, SafeDeleteContext& context, ArraySegment`1 inputBuffer, Byte[]& outputBuffer, SslAuthenticationOptions sslAuthenticationOptions)

[vcsjones]

/cc @davidsh @wfurt

[davidsh]

What OS are you using? Windows, Linux, Mac?

The cipher suites policy feature, for example, doesn't work in Windows due to OS limitations.

[Jackcu]

it throw a Exception with message that is "windows not support CipherSuitesPolicy" in windows.
in mac,it throw Interop+AppleCrypto+SslException: One or more parameters passed to a function were not valid

[wfurt]

The Windows behavior is documented and as @davidsh mentioned the ism because of underplaying OS limitations. What version of macOS and .NET do you use? I've seen something similar when testing TLS1.3. It is possible that OS does not like the particular cipher.
Can you craft runnable repo @Jackcu? And any reason for the reflection?

[Jackcu]

Thank you all for your time.
My dev-environment: Mac 10.15.3 and Windows10 1909. dotnet core 3.1.2,TLSv1.
Yes,the CipherSuites for "Client Hello" are OS dependant. eg.Schannel in Windows controls which CipherSuites are sent to server for negotiation. Accroding to the list TLS_RSA_WITH_DES_CBC_SHA (what I need) can be allowed by switch SCH_USE_STRONG_CRYPTO. Unfortunately,the switch has been used with SystemDefaults #27382.

Is there someway I can set SCH_USE_STRONG_CRYPTO in dotnet core.

[Monorihan]

you can try this method:
Win7 SP1 system, in PC Registry
HKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Control Cryptography Configuration Local SSL 0001002 Functions
TLS_RSA_WITH_DES_CBC_SHA added and TLS_RSA_WITH_NULL_XXX deleted.
Update Windows6.1-KB2533623-x64 Patch

[Jackcu]

Yes,It works fine in Win7.
OS layer modification will affect cipher suites policy of the other application.
I'm trying use detour to hook AcquireCredentialsHandle, the argument pAuthData can control which cipher suites will be filter.

[wfurt]

Did you get this solved somehow @jackcu? There is API to allow impacting ciphers but

1. it is not available on Windows 7 and
2. .NET does not use it.

I'm not sure about your comment about SCH_USE_STRONG_CRYPTO. That would be normally set unless you request weak parameters.

I don't think this issue is not actionable at the moment.

[karelz]

Closing as not actionable. Feel free to reopen if/when there is more info. Thanks!