SSL problem on Intel Celeron N3350

[vejo]

• Version: 7.9.0, 6.10.2, 4.8.2
• Platform: Windows on Intel Celeron N3350
• Subsystem: crypto

We ran into a SSL problem on an Intel Skylake (even with the latest nodejs versions), which might be caused by an invalid mac calculation. The error occurs on different systems using this processor.
Here one sample error message:

101057795:error:140943FC:
SSL routines:ssl3_read_bytes:
sslv3 alert bad record mac:
openssl\ssl\s3_pkt.c:1493:
SSL alert number 20 101057795:error:1409E0E5:
SSL routines:ssl3_write_bytes:
ssl handshake failure:openssl\ssl\s3_pkt.c:659:

Attached are programs server.js and client.js, with which the problem can be reproduced, if either server or client runs on an Intel Celeron N3350: test.zip

The problem might be in conjunction with "RSA, DH, ECDH computation failures due to CVE-2016-7055 on the Intel CPU of Broadwell or later #9594", but this issue was closed as solved.

[mscdex]

/cc @nodejs/crypto ?

[vejo]

Can I transfer the issue without duplicating?
(sorry, I'm a greenhorn...)

[tniessen]

@vejo He did not suggest a transfer to another repository, he just requested feedback from the crypto team 😃

[shigeki]

I can't reproduce this issue with the attached programs. I tested it with Node-v7.9.0 on Linux and Windows with i7-6700K (Skylake). The issue of #9594 was confirmed on that machine.

#9594 is a rare bug and caused by a specific type of private keys.

You can generate several new certificate secret keys and try to test with them. If the error is still occurs even if another certificate key is used, the issue would be caused by another reason.

[vejo]

Maybe I'm wrong with the generalization 'Skylake' and the assumption 'CVE-2016-7055'.
The error actually occurred on two Acer Spin SP111-31 (Celeron N3350).

• OK: ECDHE-RSA-AES256-GCM-SHA384,ECDHE-RSA-AES256-SHA384
• 'sslv3 alert bad record mac': ECDHE-RSA-AES128-GCM-SHA256,ECDHE-RSA-AES128-SHA256
• 'sslv3 alert handshake failure': ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-ECDSA-AES256-GCM-SHA384,DHE-RSA-AES128-GCM-SHA256,DHE-RSA-AES128-SHA256,DHE-RSA-AES256-SHA256
• ('SSL23_CLIENT_HELLO:no ciphers available': DHE-RSA-AES256-SHA384,ECDHE-RSA-AES256-SHA256) = no valid proposition

I will go on testing with different client certificates.

[vejo]

The problem does not depend on key values.

I have exchanged the server key and tested with different client keys, the problem is stable with the Acer Spin SP111-31 (Celeron N3350) test system. Modified test code: test2.zip

[vejo]

Additional test results for SSL (as client with client certificate) on the Celeron N3350 system, which might depend on different SSL implementation:

• C# and .NET framework: OK
• Microsoft Edge: OK
• Mozilla Firefox: OK
• Google Chrome: did not work, possibly caused by crypto error
• nodejs: ECONNRESET during connection establishment

[shigeki]

Is a test without client cert also failed?
Does a http test (not https) between server and client work fine?

[vejo]

Test without client cert: also fails with the same error message, as long as either server or client runs on the Celeron. But it works, when cipher is restricted to ECDHE-RSA-AES256-SHA384.

Test with http: no problem

[shigeki]

So your test results suggest the issue is caused by a cipher suite from client.

They show that

• ECDHE-RSA-AES128-SHA256 NG
• ECDHE-RSA-AES256-SHA256 OK
• ECDHE-RSA-AES256-SHA384 OK
• ECDHE-RSA-AES256-GCM-SHA384 OK

How is other following ciphers? They are all included in a default cipher list in Node.

• ECDHE-RSA-AES128-GCM-SHA256
• AES256-GCM-SHA384
• AES256-SHA256
• AES256-SHA
• AES128-GCM-SHA256
• AES128-SHA256
• AES128-SHA

[Edit: two more ciphers was added to OK]

[shigeki]

And please remove client cert auth for test simplicity.

[vejo]

Here is the result:

ECDHE-RSA-AES128-SHA256 Error: write EPROTO 101057795:error:140943FC:SSL routines:ssl3_read_bytes:sslv3 alert bad record mac:openssl\ssl\s3_pkt.c:1493:SSL alert number 20
101057795:error:1409E0E5:SSL routines:ssl3_write_bytes:ssl handshake failure:openssl\ssl\s3_pkt.c:659:

ECDHE-RSA-AES256-SHA256 Error: This socket is closed
ECDHE-RSA-AES256-SHA256 Error: 101057795:error:140740B5:SSL routines:SSL23_CLIENT_HELLO:no ciphers available:openssl\ssl\s23_clnt.c:508:

ECDHE-RSA-AES128-GCM-SHA256 Error: write EPROTO 101057795:error:140943FC:SSL routines:ssl3_read_bytes:sslv3 alert bad record mac:openssl\ssl\s3_pkt.c:1493:SSL alert number 20
101057795:error:1409E0E5:SSL routines:ssl3_write_bytes:ssl handshake failure:openssl\ssl\s3_pkt.c:659:

ECDHE-RSA-AES256-GCM-SHA384 OK
ECDHE-RSA-AES256-SHA384 OK
AES256-GCM-SHA384 OK
AES256-SHA Error: write EPROTO 101057795:error:140943FC:SSL routines:ssl3_read_bytes:sslv3 alert bad record mac:openssl\ssl\s3_pkt.c:1493:SSL alert number 20
101057795:error:1409E0E5:SSL routines:ssl3_write_bytes:ssl handshake failure:openssl\ssl\s3_pkt.c:659:

AES256-SHA256 Error: write EPROTO 101057795:error:140943FC:SSL routines:ssl3_read_bytes:sslv3 alert bad record mac:openssl\ssl\s3_pkt.c:1493:SSL alert number 20
101057795:error:1409E0E5:SSL routines:ssl3_write_bytes:ssl handshake failure:openssl\ssl\s3_pkt.c:659:

AES128-GCM-SHA256 Error: write EPROTO 101057795:error:140943FC:SSL routines:ssl3_read_bytes:sslv3 alert bad record mac:openssl\ssl\s3_pkt.c:1493:SSL alert number 20
101057795:error:1409E0E5:SSL routines:ssl3_write_bytes:ssl handshake failure:openssl\ssl\s3_pkt.c:659:

AES128-SHA256 Error: write EPROTO 101057795:error:140943FC:SSL routines:ssl3_read_bytes:sslv3 alert bad record mac:openssl\ssl\s3_pkt.c:1493:SSL alert number 20
101057795:error:1409E0E5:SSL routines:ssl3_write_bytes:ssl handshake failure:openssl\ssl\s3_pkt.c:659:

AES128-SHA Error: write EPROTO 101057795:error:140943FC:SSL routines:ssl3_read_bytes:sslv3 alert bad record mac:openssl\ssl\s3_pkt.c:1493:SSL alert number 20
101057795:error:1409E0E5:SSL routines:ssl3_write_bytes:ssl handshake failure:openssl\ssl\s3_pkt.c:659:

Test code: test3.zip
node -v: v6.10.2
Celeron as client

[shigeki]

Your tests shows that there are issues in SHA-1 and SHA256 computation but not SHA-384.
In order to conform if this is right, I would like to ask you to run the following script and get hash results of sha1,256 and 384.

const crypto = require('crypto');
const sha1 = crypto.createHash('sha1');
const sha256 = crypto.createHash('sha256');
const sha384 = crypto.createHash('sha384');

const text = 'hello world';

sha1.update(text);
sha256.update(text);
sha384.update(text);

// sha1:  2aae6c35c94fcfb415dbe95f408b9ce91ee846ed
console.log('sha1: ', sha1.digest('hex'));
// sha256:  b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9
console.log('sha256: ', sha256.digest('hex'));
//sha384:  fdbd8e75a67f29f701a4e040385e2e23986303ea10239211af907fcbb83578b3e417cb71ce646efd0819dd8c088de1bd
console.log('sha384: ', sha384.digest('hex'));

Looking at the spec of https://ark.intel.com/products/95598/Intel-Celeron-Processor-N3350-2M-Cache-up-to-2_4-GHz, it has AES-NI feature but AVX does not seems to be supported.

There is a possibility that openssl assembler build in node would leads this issue.

I'm now building node binary of Windows without using openssl asm.
I would like to ask you to run the code with that binary to see if asm causes the issue.

Is your windows 64bit version? If not, please tell me it.

[shigeki]

Here is a node binary of Windows 64bit without asm support at the latest master branch(8.0.0-pre). A openssl command (openssl-cli.exe) is also included for a tool of the further investigation. Please test with this node.exe.

node_noasm_bin.zip