5

I'm using Microsoft Crypto API to handle SSL connections. When communicating with servers that support TLS 1.0 or higher everything works fine, but when I try to deal with server that support only SSL 3.0 InitializeSecurityContext() fails with error code 0x80090331 (SEC_E_ALGORITHM_MISMATCH).

I tried to play with SCHANNEL_CRED structure that is passed to AcquireCredentialsHandle() as pAuthData argument. Particularly it has field grbitEnabledProtocols that is supposed to control the set of supported protocols. When I set grbitEnabledProtocols=SP_PROT_SSL3, everything works fine, but it breaks the security because I want to support TLS 1.0, 1.1 and 1.2 too, and it becomes impossible to communicate with servers that have SSL 3.0 disabled for security reasons.

So the problem is:

When I set grbitEnabledProtocols=SP_PROT_SSL3TLS1_X and try to communicate with server that supports SSL 3.0 only, connection starts as TLS 1.2, then server responds with SSL 3.0 header and appropriate data. From here, according to the RFC, Crypto API should continue the handshake procedure using SSL 3.0 protocol, but instead it fails with error 0x80090331 (SEC_E_ALGORITHM_MISMATCH, the client and server cannot communicate, because they do not possess a common algorithm).

Is there any possible way to enable TLS 1.0, 1.1, 1.2 along with SSL 3.0 in MS Crypto API?

jww
  • 83,594
  • 69
  • 338
  • 732
Mikhail Melnik
  • 966
  • 9
  • 19

1 Answers1

0

two things you can do as a part of debugging .

1> check is there a way to specify the supported protocols in the APIs you are using .

2> try to include all the encryption and hashing algorithms possible .

these two options are available in open SSL .

the best way is to debug is to use wireshark and look for what exactly the error code SSL protocol sends .

Simal Haneef
  • 179
  • 5
  • 1> I tried to specify protocols, and it is described in question in details. Did you read part included grbitEnabledProtocols? It is the place where one should specify supported protocols. 2> I included all the protocols and encryptions, but it did not work. I discovered that OpenSSL has the same issue, at least there is a thread with the same question: http://openssl.6102.n7.nabble.com/Need-inputs-suggestions-on-SSL-TLS-protocol-version-fallback-mechanism-td25597.html – Mikhail Melnik Jan 30 '14 at 10:16