Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

How to get it work at all?

I used this manual. I created a verifier file and started openssl s_server with a self-signed RSA certificate. Now I can't connect to it.

>gnutls-cli --srpusername user --srppasswd secret 127.0.0.1 -p 4433 --insecure
Processed 145 CA certificate(s).
Resolving '127.0.0.1'...
Connecting to '127.0.0.1:4433'...
*** Fatal error: A TLS fatal alert has been received.
*** Received alert [40]: Handshake failed
No certificates found!
*** Handshake has failed
GnuTLS error: A TLS fatal alert has been received.

Curl seems not to work too, but win32 binaries doesn't have SRP in "Features:" output from curl -V

Even openssl s_client stops working as far as I add -cipher SRP param.

openssl s_server -srpvfile xx.srp -tls1 -cipher SRP -cert ssl.crt -key ssl.key -www

-

Loading 'screen' into random state - done
CONNECTED(00000750)
2672:error:1407745B:SSL routines:SSL23_GET_SERVER_HELLO:reason(1115):.\ssl\s23_c
lnt.c:741:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 321 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
---

What now?

I'm using latest versions (OpenSSL 1.0.1e 11 Feb 2013, gnutls-3.0.22-w32, latest curl win32 build).

How should SRP accounts be registered?

Please add a tag for TLS-SRP

share|improve this question

migrated from security.stackexchange.com Mar 18 '13 at 7:02

This question came from our site for Information security professionals.

    
How are you starting the server, and does your OpenSSL version even support TLS-SRP? (≥ 1.0.1) –  grawity Mar 18 '13 at 10:14
    
Just read the manual. I use latest OpenSSL (OpenSSL 1.0.1e 11 Feb 2013). –  Smit Johnth Mar 18 '13 at 21:18

1 Answer 1

These instructions worked for me using openssl 1.0.1e compiled on win32.

Step 1. create empty SRP password file passwd.txt

Step 2. Add a user to the SRP password file

openssl srp -srpvfile passwd.txt -userinfo "This is Myself" -add myself
Enter pass phrase for myself:
Verifying - Enter pass phrase for myself:

Step 3. Start SRP server

openssl s_server -nocert -cipher SRP -srpvfile passwd.txt -accept 444
Loading 'screen' into random state - done
Using default temp DH parameters
Using default temp ECDH parameters
ACCEPT

Step 4. Connect to server

openssl s_client -srpuser myself -cipher SRP -connect localhost:444
Loading 'screen' into random state - done
CONNECTED(00000108)
Enter pass phrase for SRP user:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 2407 bytes and written 1184 bytes
---
New, TLSv1/SSLv3, Cipher is SRP-AES-256-CBC-SHA
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : SRP-AES-256-CBC-SHA
    Session-ID: 69AE0C7ED831DCCDA0E79CB5ED55E0BF9C65CA64B4077585CF9DD93CEE611358
share|improve this answer
    
Well, this seem to work. Gratulate you to be the first at all who paid attention to this question! But! 1. Seems OpenSSL creates by default 8 kbit verifier, it's a little bit too long, 1.5-2 kbit should be enough. How to do this? There is a -gN parameter, what does it do? 2. How to use this outside of openssl console tool? Even gnutls example from the manual fails. –  Smit Johnth May 22 '13 at 2:33
    
Hey! Come back please! –  Smit Johnth May 31 '13 at 11:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.