[Bug 43605] New: Wine does not support elliptic curve cryptography

https://bugs.winehq.org/show_bug.cgi?id=43605

Bug ID: 43605
           Summary: Wine does not support elliptic curve cryptography
           Product: Wine
           Version: unspecified
          Hardware: x86-64
                OS: Linux
            Status: UNCONFIRMED
          Severity: minor
          Priority: P2
         Component: -unknown
          Assignee: [e-mail]
          Reporter: [e-mail]
      Distribution: ---

Let's Encrypt and CloudFlare distribute ECC SSL certificates.

If someone tries to use it or connect to an HTTPS website that uses an ECC
certificate, Wine will claim that the certificate is invalid, and throw an
error.

If you try to view the public key directly, the dialog also claims that the
certificate is invalid. This is evident if you view the properties of the
CloudFlare ECC root certificate:
https://support.cloudflare.com/hc/en-us/articles/218689638-What-are-the-root...

[Bug 43605] Wine does not support elliptic curve cryptography

https://bugs.winehq.org/show_bug.cgi?id=43605

Fabian Maurer  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #1 from Fabian Maurer  ---
How exactly do I test that issue?

[Bug 43605] Wine does not support elliptic curve cryptography

https://bugs.winehq.org/show_bug.cgi?id=43605

--- Comment #2 from [e-mail] ---
Created attachment 59020
  --> https://bugs.winehq.org/attachment.cgi?id=59020
Comodo ECC public key

[Bug 43605] Wine does not support elliptic curve cryptography

https://bugs.winehq.org/show_bug.cgi?id=43605

--- Comment #3 from [e-mail] ---
(In reply to Fabian Maurer from comment #1)
> How exactly do I test that issue?

Hi, I've attached a certificate that should show as invalid once you click
"details" (can't remember the name).

It will say that the certificate is invalid, but it'll still install. However,
even if it's installed, Wine IE won't connect to it without the warning/error
message.

This is what it looks like on real Windows: http://i.imgur.com/fbzFl1Z.png

You can also try to access https://ssigames.co - it should also throw an error.

[Bug 43605] Wine does not support elliptic curve cryptography

https://bugs.winehq.org/show_bug.cgi?id=43605

--- Comment #4 from Fabian Maurer  ---
> Hi, I've attached a certificate that should show as invalid once you click
> "details" (can't remember the name).

How would I click on details through wine?
Mind elaborating on that, I have no idea what you are doing or how to reproduce
it.
> You can also try to access https://ssigames.co - it should also throw an
> error.

I get an "The certificate is issued by an unknown or untrusted publisher"
warning. Is that what you mean?

[Bug 43605] Wine does not support elliptic curve cryptography

https://bugs.winehq.org/show_bug.cgi?id=43605

--- Comment #5 from [e-mail] ---
(In reply to Fabian Maurer from comment #4)
> How would I click on details through wine?
> Mind elaborating on that, I have no idea what you are doing or how to reproduce it.

If you use Wine Explorer to double click the cer file, you should see a prompt
similar to the screenshot from comment #3.
> I get an "The certificate is issued by an unknown or untrusted publisher"
> warning. Is that what you mean?

Yes, that's what I mean. The root certificate is present on the system, but
Wine thinks it is invalid.

[Bug 43605] Wine does not support elliptic curve cryptography

https://bugs.winehq.org/show_bug.cgi?id=43605

[e-mail] changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

[Bug 43605] Wine does not support elliptic curve cryptography

https://bugs.winehq.org/show_bug.cgi?id=43605

--- Comment #6 from Fabian Maurer  ---
> If you use Wine Explorer to double click the cer file, you should see a
> prompt similar to the screenshot from comment #3.

No, I get an error messagebox with "There is no Windows program configured to
open this type of file."
Using a clean 32bit wineprefix with wine-2.15. Using the file from comment #2.
> Yes, that's what I mean. The root certificate is present on the system, but
> Wine thinks it is invalid.

I see. You probably mean the certificate is present on the linux system, right?

[Bug 43605] Wine does not support elliptic curve cryptography

https://bugs.winehq.org/show_bug.cgi?id=43605

--- Comment #7 from [e-mail] ---
(In reply to Fabian Maurer from comment #6)
> No, I get an error messagebox with "There is no Windows program configured
> to open this type of file."
> Using a clean 32bit wineprefix with wine-2.15. Using the file from comment
> #2.

Ah, it appears I was mistaken. I had to install ie6 from winetricks first in
order to access the certificate list. I'm not sure if that's built into Wine or
not.

I did [wine control], and then Content > Certificates > Certificates. After
that, I imported it by selecting "automatically select store" since manual
selection is broken. After that, I found the Comodo ECC certificate in the
"Trusted Root Certification Authorities" tab. If you go to the Certification
Path tab, the last one will say that it has an invalid signature.

http://i.imgur.com/0rBtpT6.png
> I see. You probably mean the certificate is present on the linux system,
> right?

Yup.

[Bug 43605] Wine does not support elliptic curve cryptography

https://bugs.winehq.org/show_bug.cgi?id=43605

Austin English  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW
           Keywords|                            |download

--- Comment #8 from Austin English  ---
(In reply to raydongf from comment #7)
> I did [wine control], and then Content > Certificates > Certificates. After
> that, I imported it by selecting "automatically select store" since manual
> selection is broken. After that, I found the Comodo ECC certificate in the
> "Trusted Root Certification Authorities" tab. If you go to the Certification
> Path tab, the last one will say that it has an invalid signature.

I can confirm that, and I can confirm that another non-ECC CA Certificate I
have (not public), does not show that issue.

That doesn't mean I verified that ECC is the cause though..

[Bug 43605] Wine does not support elliptic curve cryptography

https://bugs.winehq.org/show_bug.cgi?id=43605

--- Comment #9 from [e-mail] ---
Found a post from 2016 detailing a bit of this:
http://ccpsnorlax.blogspot.com/2016/04/ssl-issues-in-ingame-browser.html

I guess that Wine in fact does not support ECC..?

[Bug 43605] Wine does not support elliptic curve cryptography

https://bugs.winehq.org/show_bug.cgi?id=43605

Austin English  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

[Bug 43605] Wine does not support elliptic curve cryptography

https://bugs.winehq.org/show_bug.cgi?id=43605

Sagawa  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |sagawa.aki+winebugs@gmail.c
                   |                            |om

--- Comment #10 from Sagawa  ---
> From my understanding, Wine doesn't support ECC algorithms. However, we can use

ECDHE if GnuTLS supports it. So, the main issue is that we can't verify ECDSA
(Digital Signature Algorithm) which is typically used in TLS 1.2 certificates.

[Bug 43605] Wine does not support elliptic curve cryptography

https://bugs.winehq.org/show_bug.cgi?id=43605

--- Comment #11 from [e-mail] ---
(In reply to Sagawa from comment #10)
> From my understanding, Wine doesn't support ECC algorithms. However, we can
> use ECDHE if GnuTLS supports it. So, the main issue is that we can't verify
> ECDSA (Digital Signature Algorithm) which is typically used in TLS 1.2
> certificates.

Looks like GnuTLS does support both ECDHE and ECDSA, and if it's new enough,
the TLS 1.3 ECDSA algorithms as well.

[Bug 43605] Wine does not support elliptic curve cryptography

https://bugs.winehq.org/show_bug.cgi?id=43605

Scorpion  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #12 from Scorpion  ---
I use a windows client app, developed with C#/dotNet. The client connects via
TLS with an elliptic curve certificate with the server. When I use Wine, with
the proper packages installed I get a error that refers to this problem.

Since more servers use ECC I wonder if I could help/support to implement the
ECC functionality.

Btw, in contrast with the remark in comment 7, if I import the certificate I
don't see it in the "Trusted Root Certification Authorities" tab. I see the RSA
version, but not the ECC version.

[Bug 43605] Wine does not support elliptic curve cryptography

https://bugs.winehq.org/show_bug.cgi?id=43605

--- Comment #13 from Scorpion  ---
Ah I understand now that the staging environment contains the ECC format. Seems
to be working too.

[Bug 43605] Wine does not support elliptic curve cryptography

https://bugs.winehq.org/show_bug.cgi?id=43605

Zebediah Figura  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|-unknown                    |bcrypt
                 CC|                            |[e-mail]
    Staged patchset|                            |https://github.com/wine-sta
                   |                            |ging/wine-staging/tree/mast
                   |                            |er/patches/bcrypt-Improveme
                   |                            |nts
             Status|NEW                         |STAGED

--- Comment #14 from Zebediah Figura  ---
(In reply to Scorpion from comment #13)
> Ah I understand now that the staging environment contains the ECC format.
> Seems to be working too.

Marking STAGED then.

[Bug 43605] Wine does not support elliptic curve cryptography

https://bugs.winehq.org/show_bug.cgi?id=43605

Alistair Leslie-Hughes  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]
      Fixed by SHA1|                            |76b6c360fa7f3d6a0a14ed93507
                   |                            |5f5eb10f2f719
             Status|STAGED                      |RESOLVED
         Resolution|---                         |FIXED

--- Comment #15 from Alistair Leslie-Hughes  ---
https://source.winehq.org/git/wine.git/?a=commit;h=76b6c360fa7f3d6a0a14ed935...

[Bug 43605] Wine does not support elliptic curve cryptography

https://bugs.winehq.org/show_bug.cgi?id=43605

Hans Leidekker  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
      Fixed by SHA1|76b6c360fa7f3d6a0a14ed93507 |19e0f97f71c79fe52c2ace22e1f
                   |5f5eb10f2f719               |1b8c9e1416378

[Bug 43605] Wine does not support elliptic curve cryptography

https://bugs.winehq.org/show_bug.cgi?id=43605

--- Comment #16 from Hans Leidekker  ---
(In reply to Alistair Leslie-Hughes from comment #15)
> https://source.winehq.org/git/wine.git/?a=commit;
> h=76b6c360fa7f3d6a0a14ed935075f5eb10f2f719

This commit marks support for ECDSA more accurately:

commit 19e0f97f71c79fe52c2ace22e1f1b8c9e1416378
Author: Michael Müller 
Date:   Mon Mar 26 15:04:34 2018 +0200

bcrypt: Implement BCryptVerifySignature for ECDSA signatures.

[Bug 43605] Wine does not support elliptic curve cryptography

https://bugs.winehq.org/show_bug.cgi?id=43605

Alexandre Julliard  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #17 from Alexandre Julliard  ---
Closing bugs fixed in 3.5.