curl built with GnuTLS backend defaults to weak crypto parameters

How it was found

Summary:

Curl configured with GnuTLS backend (--with-gnutls) defaults using "NORMAL" as the base level of the library cryptographic security. From GnuTLS documentation:

The message authenticity security level is of 64 bits or more, and the certificate verification profile is set to GNUTLS_PROFILE_LOW (80-bits),

(Source: https://gnutls.org/manual/html_node/Priority-Strings.html)

As a result the library will allow connections using the weak message authenticity (for example 1024 bit DH group or using DH composite groups).

Note that fortunately it is quite rare to see insecure server configuration that would allow practical exploitation - however it cannot entirely be ruled out, even today.

No AI slop bullshit was used to find this issue or generate the report. Stop the slop!

Affected version

8.16.0 8.17.0-DEV (current master)

Steps To Reproduce:

1. ./configure --with-gnutls; make
2. ./src/curl https://dh1024.badssl.com/ https://dh-small-subgroup.badssl.com/ https://dh-composite.badssl.com/

Proposed Fix

The proposed fix is to default to 192bit security by using SECURE192 base level:

Means all the known to be secure ciphersuites that offer a security level 192-bit or more. The message authenticity security level is of 128 bits or more, and the certificate verification profile is set to GNUTLS_PROFILE_HIGH (128-bits).

(Source: https://gnutls.org/manual/html_node/Priority-Strings.html)

Example patch implementing the fix:

diff --git a/lib/vtls/gtls.c b/lib/vtls/gtls.c
index c79f192e8..364af7622 100644
--- a/lib/vtls/gtls.c
+++ b/lib/vtls/gtls.c
@@ -315,14 +315,14 @@ static gnutls_x509_crt_fmt_t gnutls_do_file_type(const char *type)
   return GNUTLS_X509_FMT_PEM; /* default to PEM */
 }
 
-#define GNUTLS_CIPHERS "NORMAL:-ARCFOUR-128:-CTYPE-ALL:+CTYPE-X509"
+#define GNUTLS_CIPHERS "SECURE192:-ARCFOUR-128:-CTYPE-ALL:+CTYPE-X509"
 /* If GnuTLS was compiled without support for SRP it will error out if SRP is
    requested in the priority string, so treat it specially
  */
 #define GNUTLS_SRP "+SRP"
 
 #define QUIC_PRIORITY \
-  "NORMAL:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-128-GCM:+AES-256-GCM:" \
+  "SECURE192:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-128-GCM:+AES-256-GCM:" \
   "+CHACHA20-POLY1305:+AES-128-CCM:-GROUP-ALL:+GROUP-SECP256R1:" \
   "+GROUP-X25519:+GROUP-SECP384R1:+GROUP-SECP521R1:" \
   "%DISABLE_TLS13_COMPAT_MODE"

Supporting Material/References:

• https://gnutls.org/manual/html_node/Priority-Strings.html
• https://weakdh.org/

Impact

Summary:

• Allowing weak cryptography to poorly configured servers and thus potential attackers in the man-in-the-middle position to break the cryptography.