2
$\begingroup$

General consensus is that DH_anon (and ECDH_anon) ciphersuites should be disabled since they offer no way to verify if the server is the one you intend to communicate with. However, I have never run into a client that supports DH or ECDH_anon. Could an attacker really leverage this to pull off a successful attack (with no errors/warnings?)

$\endgroup$
2
  • $\begingroup$ Could you give more context? I think what you are saying is that you typically see it recommended that DH_anon be disabled (similarly ECDH_anon) on a server since it is susceptible to MitM, but you have never seen a client that supports DH_anon (or ECDH_anon), so you are thinking it isn't really a threat in the real world. Is that accurate? $\endgroup$
    – mikeazo
    Nov 3 '14 at 19:15
  • $\begingroup$ Yes, that is the question being asked. (I'm a friend of his, posting on behalf of him.) $\endgroup$
    – flashbang
    Nov 3 '14 at 22:47
2
$\begingroup$

Ensuring that you're talking to the correct server is the client's duty. They need to verify the certificate and reject anonymous DH.

A client that accepts anon DH or doesn't verify the server's certificate is always vulnerable to MitM, even if the server disables anon DH.

Thus disabling anonymous DH on the server has little effect on security, beyond encouraging clients to choose proper ciphersuites. In the context of web applications, all popular browsers do not support anon DH to "secure" https.

$\endgroup$
1
  • $\begingroup$ Thank you! This makes sense and is the exact kind of answer I was looking for. $\endgroup$
    – user18019
    Nov 10 '14 at 14:47
1
$\begingroup$

If there are absolutely no clients that implement DH_anon (or ECDH_anon), then an attacker cannot exploit those cipher suites. When setting up your server, how do you know that there are none? How do you know someone won't plant a backdoor in a client somewhere to force those cipher suites? Better to be safe than sorry and risk your users' private data.

$\endgroup$
1
  • $\begingroup$ A client that allows anon DH is still vulnerable to MitM with anon DH even if the server disabled it. (unless perhaps it does something unusual like client certificates or other cryptographic authentication) $\endgroup$ Nov 4 '14 at 17:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.