[Cyberduck-trac] [Cyberduck] #8703: Handshake failure. Unable to negotiate an acceptable set of security parameters.

[Cyberduck]

#8703: Handshake failure. Unable to negotiate an acceptable set of security
parameters.
---------------------------+-------------------------
 Reporter:  c.sale         |         Owner:  dkocher
     Type:  defect         |        Status:  reopened
 Priority:  normal         |     Milestone:  4.7
Component:  ftp-tls        |       Version:  4.6.5
 Severity:  normal         |    Resolution:
 Keywords:                 |  Architecture:  Intel
 Platform:  Mac OS X 10.9  |
---------------------------+-------------------------
Changes (by ralf bergs):

 * status:  closed => reopened
 * resolution:  worksforme =>


Comment:

 I have the same issue towards a server I control. And as I control it I
 know it supports TLS v1.2.

 As user `c.sale` pointed out I can also log on using FileZilla and TLS
 v1.2.

 I think I have found out why Cyberduck can't connect to my server. It
 seems to only support "weak" hash algorithms in the cipher suites it
 offers. The below is from a Wireshark trace I just made:
 {{{
             Cipher Suites (28 suites)
                 Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
 (0xc00a)
                 Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)
                 Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035)
                 Cipher Suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA (0xc005)
                 Cipher Suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA (0xc00f)
                 Cipher Suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x0039)
                 Cipher Suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA (0x0038)
                 Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
 (0xc009)
                 Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)
                 Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f)
                 Cipher Suite: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA (0xc004)
                 Cipher Suite: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA (0xc00e)
                 Cipher Suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x0033)
                 Cipher Suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA (0x0032)
                 Cipher Suite: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA (0xc007)
                 Cipher Suite: TLS_ECDHE_RSA_WITH_RC4_128_SHA (0xc011)
                 Cipher Suite: TLS_RSA_WITH_RC4_128_SHA (0x0005)
                 Cipher Suite: TLS_ECDH_ECDSA_WITH_RC4_128_SHA (0xc002)
                 Cipher Suite: TLS_ECDH_RSA_WITH_RC4_128_SHA (0xc00c)
                 Cipher Suite: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
 (0xc008)
                 Cipher Suite: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA (0xc012)
                 Cipher Suite: TLS_RSA_WITH_3DES_EDE_CBC_SHA (0x000a)
                 Cipher Suite: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
 (0xc003)
                 Cipher Suite: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA (0xc00d)
                 Cipher Suite: TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA (0x0016)
                 Cipher Suite: TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA (0x0013)
                 Cipher Suite: TLS_RSA_WITH_RC4_128_MD5 (0x0004)
                 Cipher Suite: TLS_EMPTY_RENEGOTIATION_INFO_SCSV (0x00ff)
 }}}

 I have my FTP server (PureFTPD) configured to use the following suites:
 `HIGH:MEDIUM:+TLSv1:!SSLv2:!SSLv3`. This expands to the following:
 {{{
 ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-
 AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-
 AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA256:ADH-AES256
 -GCM-SHA384:ADH-AES256-SHA256:ECDH-RSA-AES256-GCM-SHA384:ECDH-ECDSA-AES256
 -GCM-SHA384:ECDH-RSA-AES256-SHA384:ECDH-ECDSA-AES256-SHA384:AES256-GCM-
 SHA384:AES256-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-
 SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:DHE-DSS-AES128
 -GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-DSS-
 AES128-SHA256:ADH-AES128-GCM-SHA256:ADH-AES128-SHA256:ECDH-RSA-AES128-GCM-
 SHA256:ECDH-ECDSA-AES128-GCM-SHA256:ECDH-RSA-AES128-SHA256:ECDH-ECDSA-
 AES128-SHA256:AES128-GCM-SHA256:AES128-SHA256
 }}}

 As you see there's no support for `SHA` (i. e. `SHA1`).

 The server therefore answers as follows:
 {{{
 No.     Time                          Source                Destination
 Protocol Length Info
      11 2015-04-19 12:24:19.039517    46.4.x.y          192.168.2.103
 TLSv1.2  73     Alert (Level: Fatal, Description: Handshake Failure)

 Frame 11: 73 bytes on wire (584 bits), 73 bytes captured (584 bits) on
 interface 0
 Ethernet II, Src: Tp-LinkT_44:59:69 (64:70:02:44:59:69), Dst:
 Apple_eb:f1:21 (c8:bc:c8:eb:f1:21)
 Internet Protocol Version 4, Src: 46.4.x.y (46.4.x.y), Dst: 192.168.2.103
 (192.168.2.103)
 Transmission Control Protocol, Src Port: 2100 (2100), Dst Port: 53716
 (53716), Seq: 341, Ack: 209, Len: 7
 Secure Sockets Layer
     TLSv1.2 Record Layer: Alert (Level: Fatal, Description: Handshake
 Failure)
         Content Type: Alert (21)
         Version: TLS 1.2 (0x0303)
         Length: 2
         Alert Message
             Level: Fatal (2)
             Description: Handshake Failure (40)
 }}}

 I think this is clearly a Cyberduck issue.

 PS: For me it's OS X 10.10.3.

-- 
Ticket URL: <https://trac.cyberduck.io/ticket/8703#comment:5>
Cyberduck <https://cyberduck.io>
Libre FTP, SFTP, WebDAV, S3 & OpenStack Swift browser for Mac and Windows