5

As we all know all EXPORT ciphers in OpenSSL should be disabled so that we are not vulnerable to the FREAK attack.

reference-

http://blog.cryptographyengineering.com/2015/03/attack-of-week-freak-or-factoring-nsa.html

I am using the string "kEDH:ALL:!ADH:!DES:!LOW:!EXPORT40:+SSLv2:@STRENGTH" with SSL_CTX_set_cipher_list() which disables EXPORT40 or export ciphers of 40-bit key length.

Also, Export56 is disabled by default from OpenSSL 0.9.8c and disables export ciphers of 56-bit key length

How do I disable other EXPORT ciphers which are part of TLS v1.0 and 'Export 1024' ciphers?

Improve this question
3
  • Looks like all EXPOR ciphers which are part of TLSv1.0 have 40bit key length and hence may have been disabled by !EXPORT40
    – user49149
    Commented Mar 6, 2015 at 9:25
  • I am guessing using !EXPORT should disable all the EXPORT ciphers .. Can anyone please confirm?
    – user49149
    Commented Mar 6, 2015 at 9:27
  • Additional recommendations: !LOW already excludes all DES, and as noted EXPORT40 are the only EXPORT. On 1.0.0+ if you put kEDH first for PFS you should do kEECDH also, and if you excluded !ADH for safety you should exclude !AECDH also or more simply just !aNULL does both. Unless you actually need SSLv2 which I hope not, you should !SSLv2 instead of +, especially on client because if code uses the generic "v23" method without OP_NO_version flags, enabling any v2 ciphers uses the highly undesirable v2 Hello format.
    – dave_thompson_085
    Commented Jun 21, 2015 at 5:57

2 Answers 2

Reset to default
1

you can add !EXPORT in place to :!EXPORT40 it will disable all export cipher

this link may provide much more information about Freak & Export cipher http://openssl.6102.n7.nabble.com/openssl-users-How-to-disable-all-EXPORT-Ciphers-td56861.html

Improve this answer
0

Only the original 40-bit EXPORT ciphers are affected by the attack anyway. It is unfortunate that OpenSSL disabled the 56-bit EXPORT1024 ciphers back in 2006. And yes these are the only two categories of EXPORT ciphers in SSL/TLS.

Improve this answer
2
  • Is it possible to amend this answer so that it includes the OpenSSL specific configuration required?
    – Maarten Bodewes
    Commented Mar 10, 2015 at 12:41
  • append !EXPORT to the string which is passed on to SSL_CTX_set_cipher_list(). This should exclude all EXPORT ciphers
    – user49149
    Commented Apr 21, 2015 at 15:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .