Projects tigase _server server-core Issues #1074
Hardened Mode improvements (#1074)
Closed
wojciech.kapcia@tigase.net opened 5 years ago

When using hardened mode

  • should only eliminate weak protocols/ciphers instead of using fixed list, they are currently hardcoded:
	private static final String[] HARDENED_MODE_FORBIDDEN_CIPHERS = new String[]{
			"TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",
			"SSL_RSA_WITH_3DES_EDE_CBC_SHA", "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA",
			"TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA", "SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA",
			"SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "TLS_ECDHE_RSA_WITH_RC4_128_SHA",
			"SSL_RSA_WITH_RC4_128_SHA", "TLS_ECDH_ECDSA_WITH_RC4_128_SHA", "TLS_ECDH_RSA_WITH_RC4_128_SHA",
			"SSL_RSA_WITH_RC4_128_MD5", "SSL_RSA_EXPORT_WITH_RC4_40_MD5", "TLS_KRB5_WITH_RC4_128_SHA",
			"TLS_KRB5_WITH_RC4_128_MD5", "TLS_KRB5_EXPORT_WITH_RC4_40_SHA", "TLS_KRB5_EXPORT_WITH_RC4_40_MD5"};
	private static final String[] HARDENED_MODE_PROTOCOLS = new String[]{"SSLv2Hello", "TLSv1", "TLSv1.1", "TLSv1.2"};
wojciech.kapcia@tigase.net commented 5 years ago
issue 1 of 1
Type
New Feature
Priority
Normal
Assignee
Version
tigase-server-8.1.0
Spent time
40h 45m
Issue Votes (0)
Watchers (0)
Reference
tigase/_server/server-core#1074
Please wait...
Page is in error, reload to recover