On Sat, Dec 27, 2008 at 08:42:19PM -0500, Hector Santos wrote:
> I'm finally catching up and updating our OPENSSL *.dll distribution
> with the latest build (0.9.8i). We had 0.9.8a (2006 time frame)
>
> The main reason is because we got inquiries regarding AES and SSL3 and
> cipher suites.
>
> I am trying to recall all our work, but I thought we had server
> support for this already by allowing the server operator to set the
> cipher suite in his ssl host setup to:
>
> ALL:!ADH:RC4+RSA:+SSLv3:@STRENGTH
This is probably an unwise cipher selection:
- Not all no-authentication ciphers are ADH ciphers, some are
AECDH ciphers. While your build may not currently enable EC
ciphers by default, future releases will.
* USE "ALL:!aNULL" not "ALL:!ADH".
- The built-in definitions of "ALL" and "DEFAULT" differ exactly
in the removal of "aNULL" ciphers from "ALL" to yield "DEFAULT".
In some releases of OpenSSL, the "DEFAULT" ciphers have a more
sensible order, starting with 0.9.9 the order will be the same.
* USE "DEFAULT" instead of "ALL:!aNULL"
- The "RC4+RSA" ciphers are already included in ALL, adding these
explicitly is NOP.
* Drop the "RC4+RSA" cipherlist element.
- The "+SSLv3" element forces SSLv3 ciphers to be listed after SSLv2
ciphers. In all probability the v3 protocol is selected before the
cipher is selected, so this has no effect. If I am mistaken in
the protocol selection happening first, preferring SSLv2 to SSLv3
is really unwise.
* Drop the "+SSLv3" element
- Finally, in most server applications the server accepts the client's
cipher preferences (though OpenSSL does offer an interface for the
server to request priority for its own cipherlist). So you typically
don't need to order the server's list at all.
- Bottom line:
* Use "DEFAULT", nothing in your original cipherlist appears to
offer any meaningful advantage over the "DEFAULT" setting.
--
Viktor.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [email protected]
Automated List Manager [email protected]
