2

I have a legacy application which sits on Java 6(!), and talks to Apache 2.2.15 on RHEL 6.4.

(An upgrade for Java 6 is on the cards, but not before go-live date.)

We have pentest fails for a weak TLS configuration, so I want to find the best ciphersuite that both Java 6 and Apache will support, without any modifications e.g. no adding of crypto providers to Java.

I've looked at the Client Hello coming from the Java app, and having removed the suites I know I will get failed for (export grade, RC4, etc), this is what I'm left with:

TLS_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
TLS_DHE_RSA_WITH_AES_128_CBC_SHA
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_DHE_DSS_WITH_AES_128_CBC_SHA
TLS_DHE_DSS_WITH_AES_256_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA

Bear in mind I only have one client to support for this, so one ciphersuite that both sides support will suffice.

I realise there may not be a clear cut answer to this, so any advice is appreciated.

Improve this question
6
  • Bear in mind that all the 3DES ones have been shown to offer 58 bit equivalent strength, despite nominally being higher - depending on your pentest provider, this might be highlighted as offering lower protection than you wanted.
    – Matthew
    Commented Nov 20, 2015 at 11:15
  • I thought 3DES might be out, just included because I wasn't sure.
    – gtmcclinton
    Commented Nov 20, 2015 at 11:18
  • I found a tool here nartac.com/Products/IISCrypto/Download that lists the preferred order of ciphersuites, and the first one in that that both can support is TLS_RSA_WITH_AES_256_CBC_SHA, or AES256-SHA in apache-speak. One of the pentest recommednations is to avoid CBC mode, but I can't with what I have available at the moment. So is this the best of a bad bunch?
    – gtmcclinton
    Commented Nov 20, 2015 at 11:21
  • Although the Java client hello list lists the AES128 version above that, (and incidentally two RC4 ciphersuites above that). So why does it consider AES128 better than AES256?
    – gtmcclinton
    Commented Nov 20, 2015 at 11:23
  • 2
    @Matthew 3DES is not 58-bit, it's 112-bit. That said some Pentest providers still mark it as "insecure" for being less that 128-bit, so best avoided. (the fact that no-one has ever actually cracked a 112-bit key is apparently neither here nor there.
    – Rory McCune
    Commented Nov 20, 2015 at 12:01

1 Answer 1

Reset to default
3

I tend to go off the list that Mozilla provides, which gets updated every so often, although no where near as frequently as browsers do!

This currently suggests the following cipher order for a "modern" browser:

ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK

This would suggest that the best option you have is DHE-RSA-AES128-SHA (which I am fairly sure is Apache speak for TLS_DHE_RSA_WITH_AES_128_CBC_SHA).

Not sure why the AES128 one would be preferred over AES256, but it is the same in the Mozilla list.

Edit

Original version stated "DHE-RSA-AES128-SHA256", which was wrong - fingers used to typing SHA256...

Improve this answer
3

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .