Tomcat 7 Ciphers for High Security

Question

I migrated to Tomcat 7 and realized that it was time to check the ciphers that I use for SSL connections. I realized that I put them about 5 years ago and since then I have not thought about them.

Are there any important ciphers on my list? Does it include any I shouldn't?

My web application is one where security is important, so it is preferable to make a mistake with caution. Requires IE8 support, international users (but not North Korea).

ciphers="TLS_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, 
TLS_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, 
SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA"

Answer 1

Short version:

• Add TLS_RSA_WITH_AES_128_CBC_SHA256
• Add TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
• Add TLS_DHE_DSS_WITH_AES_128_CBC_SHA25
• 3DES, XP.

:

JVM . JVM - , .

package org.apache.markt;

import java.security.NoSuchAlgorithmException;
import java.security.Security;
import java.util.Set;
import javax.crypto.Cipher;
import javax.net.ssl.SSLServerSocketFactory;

public class CryptoInfo {
    public static void main(String[] args) {
        try {
            Set<String> algorithms = Security.getAlgorithms("Cipher");
            for(String algorithm: algorithms) {
                int max;
                max = Cipher.getMaxAllowedKeyLength(algorithm);
                System.out.printf("%-22s: %dbit%n", algorithm,
                        Integer.valueOf(max));
            }
        } catch (NoSuchAlgorithmException e) {
            e.printStackTrace();
        }

        SSLServerSocketFactory f =
            (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
        String[] cs = f.getSupportedCipherSuites();
        for (String c : cs) {
            System.out.println(c);
        }

    }
}

, , - KRB5 . TLS_EMPTY_RENEGOTIATION_INFO_SCSV ( , , ), . , NULL, anon, export DES . RC4 , , , . IE8 ECDH, . IE8 XP ECDHE, .

, : TLS_RSA_WITH_AES_128_CBC_SHA256 TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 TLS_DHE_DSS_WITH_AES_128_CBC_SHA256

, , 3DES . , IE8 XP AES (IE8 Vista ). , , .

:

http://www.g-sec.lu/sslharden/SSL_comp_report2011.pdf

https://www.ssllabs.com/downloads/SSL_TLS_Deployment_Best_Practices_1.3.pdf