Missing some params in TLS handshakes

[Seanstoppable]

I'm trying to upgrade zgrab2, and was running into issues parsing some some HTTPS responses.

Digging in, it looks like that that the upgrade of zcrypto in PR 73944fc includes a bug where params are not being returned.

Example:

echo 44.201.23.212 | ./zgrab2 http --use-https --port 443 | jq .

Has the y value of the client public (and server public) section missing. Currently unsure if other fields are missing/if other key exchange types are impacted.

Before PR:

"client_key_exchange": {
                  "ecdh_params": {
                    "curve_id": {
                      "name": "secp256r1",
                      "id": 23
                    },
                    "client_public": {
                      "x": {
                        "value": "u+wDV175UmrKs3LKDIk+fv/4tGacx+p1zNvBQKZeJLw=",
                        "length": 256
                      },
                      "y": {
                        "value": "wTH+YyAbZlq+YD+0arRG1n2XMov5FsrOqqIB5+cFtVE=",
                        "length": 256
                      }
                    },
                    "client_private": {
                      "value": "JcqpI2SK9iqxNgyMUzo8iCI/xQoH0nm9LgBZQdRd4Yc=",
                      "length": 32
                    }
                  }
                },

After PR:

"client_key_exchange": {
                  "ecdh_params": {
                    "curve_id": {
                      "name": "x25519",
                      "id": 29
                    },
                    "client_public": {
                      "x": {
                        "value": "JyC9lf3rfMIe0eTx1ylKqpbwgyu2lxz1207bYsq90FM=",
                        "length": 256
                      }
                    },
                    "client_private": {
                      "value": "3qr3ofRE2k2d2eYuMzLukDBwQp2x85ZUqtm3uPL2kKk=",
                      "length": 32
                    }
                  }
                },

[mzpqnxow]

Good eye.

I see the former is secp256r1 and the latter is x25519 - is the quirk related to that? Do you see the same when comparing x25519 on the older version with x25519 on the newer version?

What I’m getting at is the possibility that it’s a quirk more to do with how it displays x25519 rather than a regression/change

[Seanstoppable]

@mzpqnxow That may be correct. Wikipedia suggests only x params https://en.wikipedia.org/wiki/Curve25519