I've just now discovered that SSL_CTX_set_cipher_list() takes parameters in
a different format than I thought. How do you add the EXP1024 ciphers that
you mention? I've tried passing all kinds of strings to
SSL_CTX_set_cipher_list() but with no success in limiting connections to
56-bit (I can get 40-bit or 64-bit+, but not 56).
Also, can anyone explain what these things do:
-HIGH !HIGH +HIGH -MEDIUM !MEDIUM +HIGH -LOW !LOW
+EXP +EXPORT56
etc.
I'm a little confused about when the '+' is needed and the difference
between ! and -.
----- Original Message -----
From: Joerg Bartholdt <[EMAIL PROTECTED]>
To: OpenSSL Users Mailing List <[EMAIL PROTECTED]>
Sent: Tuesday, November 02, 1999 4:16 AM
Subject: Re: Restricting to 56-bits
> I'm still wondering how to restrict the client end of the connection to
> supporting only 56 bits. I found that I could restrict it to 40-bits with
> this fragment of code, but I can't figure out how to do 56-bits:
> char *allowed_ciphers = {
> "EXP-EDH-RSA-DES-CBC-SHA,"
> "EXP-EDH-DSS-DES-CBC-SHA,"
> "EXP-DES-CBC-SHA,"
> "EXP-RC2-CBC-MD5,"
> "EXP-RC4-MD5,"
> "EXP-RC2-CBC-MD5,"
> "EXP-RC4-MD5,"
> };
> SSL_set_cipher_list(ssl, allowed_ciphers);
> Thanks for any additional tips anyone can provide.
Try the EXP1024 cihpers:
Suite EXP1024-DHE-DSS-RC4-SHA kDH aDSS RC4 SHA
EXP56 SSLv3/TLSv1 0 added
Suite EXP1024-RC4-SHA kRSA aRSA RC4 SHA
EXP56 SSLv3/TLSv1 0 added
Suite EXP1024-DHE-DSS-DES-CBC-SHA kDH aDSS DES SHA
EXP56 SSLv3/TLSv1 0 added
Suite EXP1024-DES-CBC-SHA kRSA aRSA DES SHA
EXP56 SSLv3/TLSv1 0 added
Suite EXP1024-RC2-CBC-MD5 kRSA aRSA RC2 MD5
EXP56 SSLv3/TLSv1 0 added
Suite EXP1024-RC4-MD5 kRSA aRSA RC4 MD5
EXP56 SSLv3/TLSv1 0 added
As you can see, they use the EXP56 bit strength.
Cheers,
Joerg
==========================================================================
"Who the hell is General Failure, and why is he reading my harddisk ?"
==========================================================================
Joerg Bartholdt email : [EMAIL PROTECTED]
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
