I have received the following advise to set cipher suites to suitably mitigate Beast attack on a newly setup Apache HTTPD server.
Preferred ciphers: RC4-SHA, RC4-MD5 Must Have Ciphers: AES256-SHA, AES128-SHA, DES-CBC3-SHA, RC4-SHA, RC4-MD5
I want to confirm my understanding of the differences between "preferred ciphers" and "must-have ciphers". My queries are:
Is the advise stating that the server should support the following ciphers in this order?
1. RC4-SHA 2. RC4-MD5 2. AES256-SHA 3. AES128-SHA 4. DES-CBC3-SHA
Should the advice translate to the following code for Apache mod_ssl?
SSLHonorCipherOrder On SSLCipherSuite RC4-SHA:RC4-MD5:AES256-SHA:AES128-SHA:DES-CBC3-SHA
Shouldn't the advise really state:
Preferred ciphers: RC4-SHA, RC4-MD5, AES256-SHA, AES128-SHA, DES-CBC3-SHA Must Have Ciphers: AES256-SHA, AES128-SHA, DES-CBC3-SHA, RC4-SHA, RC4-MD5 OR Preferred & Must have ciphers: RC4-SHA, RC4-MD5, AES256-SHA, AES128-SHA, DES-CBC3-SHA
Are "preferred cipher" and "must have cipher" terms common terminology for expressing cipher suites in security world?