blob: 645e44a9371106b6ea3af938c046b56c4becf6f9 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
|
TLS Version & Cipher Suites
---------------------------
ucspi-ssl provides two hooks to adjust the TLS version and the Cipher Suite:
1. Client and Server (sslclient, sslhandle, sslserver):
The TLS/SSL protocol versions
- SSLv2 and
- SSLv3
are disabled in ucspissl.h.
- TLSv1 is already included here, but is still commented out.
2. The Cipher Suite accepted by the Server (sslhandle, sslserver)
a) Pre-TLS 1.3
Here, you can adjust the settings by means of CIPHER environment variables.
Some typical choices:
#CIPHERS="'TLSv1+HIGH:!SSLv2:!aNULL:!eNULL:!3DES:@STRENGTH'"
#CIPHERS="TLSv1+HIGH:!SSLv2:!MD5"
CIPHERS="TLSv1.2+HIGH:TLSv1.1+HIGH:!TLSv1+HIGH:!aNULL:!eNULL:@STRENGTH"
This variable can be statically defined for all connections or used
as environment variable specified with the tcprule database.
OpenSSL supports even very old and inscure crypto primites like MD5 or DES;
however under current circumstances they are not negotiated.
b) TLS 1.3
While previous TLS understand some phrasings like 'DEFAULT', 'HIGH' in TLS 1.3
a new API and a new scheme is used
(https://www.openssl.org/docs/man1.1.1/man3/SSL_CTX_set_cipher_list.html):
>> An empty list is permissible. The default value for the this setting is:
"TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256" <<
This means 'TLS_AES_256_GCM_SHA384' has priority. However, you can tweak this to:
"TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256"
thus, the first choice is CHACHA20. In case AES_256 is present, it has
precedence over CHACHA20.
Remember: In any case, only ECDHE is used as handshake protocol.
3. Online Resources
OpenSSL: https://www.openssl.org/docs/man1.1.1/man3/SSL_CTX_set_cipher_list.html
LibreSSL: https://fossies.org/linux/libressl/man/SSL_CTX_set_cipher_list.3
--eh, Oktober 2023.
|
