3 ms·

Reproducing an earlier comment I made on Reddit (http://www.reddit.com/r/netsec/comments/1mn2nk/ssltls_deployment_best_practices/ccarooh http://www.reddit.com/r

by dguido 13y ago

Reproducing an earlier comment I made on Reddit (http://www.reddit.com/r/netsec/comments/1mn2nk/ssltls_deployment_best_practices/ccarooh http://www.reddit.com/r/netsec/comments/1mn2nk/ssltls_deploy...): If you want the short version for Apache, Nginx and OpenSSL: http://blog.ivanristic.com/2013/08/configuring-apache-nginx-and-openssl-for-forward-secrecy.html http://blog.ivanristic.com/2013/08/configuring-apache-nginx-... SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS" For those who don't give a shit if Windows XP / IE can establish an SSL connection with you, here's a cipher string without RC4. SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4" More details, including the configurations for SSL/TLS protocol versions, can be found at the link above.

oleganza 13y ago
Why do you have both "RC4" and "!RC4" in the second string?
- aroch 13y ago
  As far as I understand it, the server will respond RC4 ciphered negotiations by saying "sorry , what?" instead of "fuck off" if you include it in both the accepted and refused lists. In doing so, it'll force a renegotiation over an accepted cipher combo
- ivanr 13y ago
  It makes sense in the context of (my) blog post. I start by showing one configuration for those who wish to use RC4 to mitigate the BEAST attack (better suites are used for the clients that support TLS 1.2). In the subsequent section, for those who do not care about BEAST and don't like RC4, I show how they can simply add !RC4 to the end. The advantage is that the configuration string remains the same.
e12e 13y ago
I was a bit disappointed that the guide didn't include cipher suite strings/openssl config strings for the recommendations given (or did I miss it?). I'd like to see the minimal strings needed for a) only tls 1.2 with RSA keys, b) like a, with DSA -- with only forward secrecy enabled -- and a' and b' with fall back to no forward secrecy. I don't suppose there's any reason to allow eg: EECDH+ECDSA+AESGCM if you only have certificates based on RSA?
- ivanr 13y ago
  I understand your point, but I am trying very hard to keep the guide as short as possible. The problem is that, if you start to be inclusive, the size balloons. I've written hundreds of pages on this topic so far (for my forthcoming book) and I don't yet feel I've covered everything sufficiently. Further, people often want to deploy something that's just slightly different -- like your request to use only RSA keys, then DSA, and so on. I've come to realise that the only way to make everyone happy is to teach them to write configuration strings for themselves. That's how OpenSSL Cookbook (my free ebook) came about. In addition, my blog (referenced above) has many specialist posts; I write them as I research stuff for my book. To your last question: no, there's no reason to use ECDSA anywhere if you only have RSA keys... but I prefer to use the same configuration string everywhere. It makes maintenance much easier.

by dguido 13y ago

oleganza 13y ago

Why do you have both "RC4" and "!RC4" in the second string?

aroch 13y ago
As far as I understand it, the server will respond RC4 ciphered negotiations by saying "sorry , what?" instead of "fuck off" if you include it in both the accepted and refused lists. In doing so, it'll force a renegotiation over an accepted cipher combo
ivanr 13y ago
It makes sense in the context of (my) blog post. I start by showing one configuration for those who wish to use RC4 to mitigate the BEAST attack (better suites are used for the clients that support TLS 1.2). In the subsequent section, for those who do not care about BEAST and don't like RC4, I show how they can simply add !RC4 to the end. The advantage is that the configuration string remains the same.

e12e 13y ago

I was a bit disappointed that the guide didn't include cipher suite strings/openssl config strings for the recommendations given (or did I miss it?). I'd like to see the minimal strings needed for a) only tls 1.2 with RSA keys, b) like a, with DSA -- with only forward secrecy enabled -- and a' and b' with fall back to no forward secrecy. I don't suppose there's any reason to allow eg: EECDH+ECDSA+AESGCM if you only have certificates based on RSA?

ivanr 13y ago
I understand your point, but I am trying very hard to keep the guide as short as possible. The problem is that, if you start to be inclusive, the size balloons. I've written hundreds of pages on this topic so far (for my forthcoming book) and I don't yet feel I've covered everything sufficiently. Further, people often want to deploy something that's just slightly different -- like your request to use only RSA keys, then DSA, and so on. I've come to realise that the only way to make everyone happy is to teach them to write configuration strings for themselves. That's how OpenSSL Cookbook (my free ebook) came about. In addition, my blog (referenced above) has many specialist posts; I write them as I research stuff for my book. To your last question: no, there's no reason to use ECDSA anywhere if you only have RSA keys... but I prefer to use the same configuration string everywhere. It makes maintenance much easier.