TLS Client Hello Failed with server which use ed25519-signed certificate

The first thing I would do is take a packet trace if you think there is a handshake negotiation failure going on in client hello. "alert number 40," after the client hello could mean that a cipher suite was not agreed upon by the server, or that there was an issue with the server's certificate for specific Subject Name information. To find out what is happening here, the best thing to do is look at it over the wire with a packet trace.


Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com

Hi Matt
After taking a packet trace, we found there is no ed25519 signature algorithms in client hello packet. It didn't pass the validation in TLS negotiation by our server which is using a ed25519-signed certifacate

how can I add ed25519 signature algorithms in client hello packet?

1, part of client hello packet from ios14.2

Code Block language
Cipher Suites (27 suites)
    Cipher Suite: Reserved (GREASE) (0x8a8a)
    Cipher Suite: TLS_AES_128_GCM_SHA256 (0x1301)
    Cipher Suite: TLS_AES_256_GCM_SHA384 (0x1302)
    Cipher Suite: TLS_CHACHA20_POLY1305_SHA256 (0x1303)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (0xc02c)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca9)
    Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)
    Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)
    Cipher Suite: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca8)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 (0xc024)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 (0xc023)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009)
    Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028)
    Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027)
    Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)
    Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)
    Cipher Suite: TLS_RSA_WITH_AES_256_GCM_SHA384 (0x009d)
    Cipher Suite: TLS_RSA_WITH_AES_128_GCM_SHA256 (0x009c)
    Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA256 (0x003d)
    Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA256 (0x003c)
    Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035)
    Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA (0xc008)
    Cipher Suite: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA (0xc012)
    Cipher Suite: TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000a)
Extension: signature_algorithms (len=24)
    Type: signature_algorithms (13)
    Length: 24
    Signature Hash Algorithms Length: 22
    Signature Hash Algorithms (11 algorithms)
        Signature Algorithm: ecdsa_secp256r1_sha256 (0x0403)
        Signature Algorithm: rsa_pss_rsae_sha256 (0x0804)
        Signature Algorithm: rsa_pkcs1_sha256 (0x0401)
        Signature Algorithm: ecdsa_secp384r1_sha384 (0x0503)
        Signature Algorithm: ecdsa_sha1 (0x0203)
        Signature Algorithm: rsa_pss_rsae_sha384 (0x0805)
        Signature Algorithm: rsa_pss_rsae_sha384 (0x0805)
        Signature Algorithm: rsa_pkcs1_sha384 (0x0501)
        Signature Algorithm: rsa_pss_rsae_sha512 (0x0806)
        Signature Algorithm: rsa_pkcs1_sha512 (0x0601)
        Signature Algorithm: rsa_pkcs1_sha1 (0x0201)
Extension: supported_versions (len=11)
    Type: supported_versions (43)
    Length: 11
    Supported Versions length: 10
    Supported Version: Unknown (0xfafa)
    Supported Version: TLS 1.3 (0x0304)
    Supported Version: TLS 1.2 (0x0303)
    Supported Version: TLS 1.1 (0x0302)
    Supported Version: TLS 1.0 (0x0301)

2,Server response

Code Block language
Transport Layer Security
    TLSv1.2 Record Layer: Alert (Level: Fatal, Description: Handshake Failure)
        Content Type: Alert (21)
        Version: TLS 1.2 (0x0303)
        Length: 2
        Alert Message
            Level: Fatal (2)
            Description: Handshake Failure (40)

After taking a packet trace, we found there is no ed25519 signature algorithms in client
hello packet. It didn't pass the validation in TLS negotiation by our server which is
using a ed25519-signed certifacate

Okay, you have now determined where the breakdown is. You will now need to align your server to negotiate the security requirements that the iOS device is presenting in the client hello. I would talk to your server side team for more information on how to align your certificate requirements with those presented from the iOS device.


Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com

Hi Matt
Thanks for replying

1. is it possible to add ed25519 in the security requirements that the iOS device is presenting in the client hello?

2. our server url is in attachment,could you help us to diagnostics why it failed to negotiate with iOS device?

3. is there any solution to make security connections between iOS device and a server with ed25519-signed certificate?

our server url is in attachment,could you help us to diagnostics why it failed to negotiate with iOS device?

It looks like you have already done this in the thread above.

is it possible to add ed25519 in the security requirements that the iOS device is presenting in the client hello?

You can open an enhancement request for this, but the shortest path to success here would be to support the negotiated security requirements sent to your server from the iOS device.

is there any solution to make security connections between iOS device and a server with ed25519-signed certificate?

If this is a self signed certificate my recommendation to you would be to get a leaf certificate issued from one of the CA's that already exists in the devices trust store. This will give you the most flexibility in configuring your server for communicating with an iOS device.


Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com