Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a Jetty based secure http service, and I wish to support GCM cipher suites. I know that Jetty internally use JSSE based ciphers, and there are many GCM ciphers coming with JSSE as documented here - http://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html#ciphersuites

However, I can't get Jetty to support any of these. For eg: I configure the below ones for Jetty

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

but are not listed as supported ciphers from an SSL scan.

I searched a lot, and also cannot figure out where to look for available JSSE ciphers in a distribution. Any help would be appreciated.

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

The document you are linking to lists only the standard cipher suite names; it does not promise that all these cipher suites are actually supported by any JSSE provider, in particular the one which comes with Java and is called SunJSSE. That the standard name TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 is defined just means that if a JSSE provider wants to provide support for that cipher suite, then it must provide it under that name.

This document, which allegedly pertains to Java 7 as well, lists the cipher suites which SunJSSE actually supports; some enabled by default, others disabled by default. I see no GCM cipher suite at all...

Support for GCM cipher suites may be added in a future version; you might want to try some previews of Java 8 (Java 8 release is due March 2014). In any case, GCM cipher suites in SSL require TLS 1.2 (they don't work with previous protocol versions), and the AES_256 is 256-bit AES which, with the cryptographic implementations provided with Java, requires the JCE Unlimited Strength Jurisdiction Policy Files (a remnant of the US export regulations on cryptographic material).

share|improve this answer
    
Thanks! TLS 1.2 is already supported in my case, and have patched the jdk distribution with JCE unlimited policy files. I tried with JDK8 as well, but it doesn't provide GCM cipher suites. Perhaps I should experiment with some JCE providers. I had a quick test with Bouncy Castle library, but looks like it doesn't offer any GCM suites either. :( –  user30622 Sep 11 '13 at 16:42
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.