Hardened Mode improvements (#1074)

Wojciech Kapcia (Tigase) opened 6 years ago

When using hardened mode

should only eliminate weak protocols/ciphers instead of using fixed list, they are currently hardcoded:

	private static final String[] HARDENED_MODE_FORBIDDEN_CIPHERS = new String[]{
			"TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",
			"SSL_RSA_WITH_3DES_EDE_CBC_SHA", "TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA",
			"TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA", "SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA",
			"SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "TLS_ECDHE_RSA_WITH_RC4_128_SHA",
			"SSL_RSA_WITH_RC4_128_SHA", "TLS_ECDH_ECDSA_WITH_RC4_128_SHA", "TLS_ECDH_RSA_WITH_RC4_128_SHA",
			"SSL_RSA_WITH_RC4_128_MD5", "SSL_RSA_EXPORT_WITH_RC4_40_MD5", "TLS_KRB5_WITH_RC4_128_SHA",
			"TLS_KRB5_WITH_RC4_128_MD5", "TLS_KRB5_EXPORT_WITH_RC4_40_SHA", "TLS_KRB5_EXPORT_WITH_RC4_40_MD5"};
	private static final String[] HARDENED_MODE_PROTOCOLS = new String[]{"SSLv2Hello", "TLSv1", "TLSv1.1", "TLSv1.2"};

we should have 3 levels (from mail "Re: Hardened Mode" from 03/07/2019 13:35:
- relaxed - what's provided by JDK
- secure (current hardened) [default]: allowing at the most items with grey background on xmpp.net (https://xmpp.net/result.php?domain=tigase.im&type=client#protocols)
- strict - either recommendations from Mozilla modern (https://ssl-config.mozilla.org/#server=nginx&server-version=1.14.0&openssl-version=1.1.1&hsts=true&config=modern) or "green only" items from xmpp.net; (ciphers without Forward secrecy and removed TLS1.0 and TLS1.1)

Related
- Improve "Key exchange score" (#1124) Open

Activities

Wojciech Kapcia (Tigase) commented 6 years ago

https://www.ssllabs.com/projects/rating-guide/index.html https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide
Login to comment

Type	New Feature
Priority	Normal
Assignee	Wojciech Kapcia (Tigase)
Version	tigase-server-8.1.0
Spent time	0

Issue Votes (0)

Watchers (0)

Reference

tigase/_server/server-core#1074