4

According to this blogpost Perfect Forward Secrecy (PFS) is provided by:

Anything on the Algorithm Standard Name list that start with TLS (Transport Level Security) followed by a type of DHE (Diffie-Hellman Exchange).

E.g. TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA

I want to achieve this by using Java's 'jdk.tls.disabledAlgorithms' property in java.security file. Right now I have the following values for that property:

jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, RC4, MD5, DESede, DH keySize < 768, RSA keySize < 2048

And following is the result by TestSSLServer:

$ java -jar TestSSLServer.jar 127.0.0.1 9443
Supported versions: TLSv1.2
Deflate compression: no
Supported cipher suites (ORDER IS NOT SIGNIFICANT):
  TLSv1.2
     DHE_RSA_WITH_AES_128_CBC_SHA
     DHE_RSA_WITH_AES_256_CBC_SHA
     DHE_RSA_WITH_AES_128_CBC_SHA256
     DHE_RSA_WITH_AES_256_CBC_SHA256
     TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
     TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
     TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
     TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
     TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
     TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
     TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
     TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
----------------------
Server certificate(s):
  xxxxx
----------------------
Minimal encryption strength:     strong encryption (96-bit or more)
Achievable encryption strength:  strong encryption (96-bit or more)
BEAST status: protected
CRIME status: protected

I still couldn't find a mechanism to get rid of suites that don't provide PFS. E.g. 'DHE_RSA_WITH_AES_128_CBC_SHA'.

Can we get this done by 'jdk.tls.disabledAlgorithms'? If not, is there any other JVM level mechanism?

UPDATE:

After @Steffen confirmed that all my previous listed ciphers provided PFS, I tested again with another server and can see RSA getting listed as a key exchange algorithm. This time tried with 2 tools - both recommended by OWASP

jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, RC4, MD5, DESede, RSA keySize < 2048

NOTE: Setting 'DH keySize < 2048' using this property didn't have any effect. I had to use the system property "-Djdk.tls.ephemeralDHKeySize=2048" to increase the DH key size as recommended by @Steffen.

TestSSLServer

Supported cipher suites (ORDER IS NOT SIGNIFICANT):
  TLSv1.2
     RSA_WITH_AES_128_CBC_SHA
     DHE_RSA_WITH_AES_128_CBC_SHA
     RSA_WITH_AES_256_CBC_SHA
     DHE_RSA_WITH_AES_256_CBC_SHA
     RSA_WITH_AES_128_CBC_SHA256
     RSA_WITH_AES_256_CBC_SHA256
     DHE_RSA_WITH_AES_128_CBC_SHA256
     DHE_RSA_WITH_AES_256_CBC_SHA256
     TLS_RSA_WITH_AES_128_GCM_SHA256
     TLS_RSA_WITH_AES_256_GCM_SHA384
     TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
     TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
     TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
     TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
     TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
     TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
     TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
     TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

testssl.sh

Testing all 124 locally available ciphers against the server, ordered by encryption strength 

Hexcode  Cipher Suite Name (OpenSSL)       KeyExch.  Encryption Bits
------------------------------------------------------------------------
 xc030   ECDHE-RSA-AES256-GCM-SHA384       ECDH 256   AESGCM    256       
 xc028   ECDHE-RSA-AES256-SHA384           ECDH 256   AES       256       
 xc014   ECDHE-RSA-AES256-SHA              ECDH 256   AES       256       
 x9f     DHE-RSA-AES256-GCM-SHA384         DH 2048    AESGCM    256       
 x6b     DHE-RSA-AES256-SHA256             DH 2048    AES       256       
 x39     DHE-RSA-AES256-SHA                DH 2048    AES       256       
 x9d     AES256-GCM-SHA384                 RSA        AESGCM    256       
 x3d     AES256-SHA256                     RSA        AES       256       
 x35     AES256-SHA                        RSA        AES       256       
 xc02f   ECDHE-RSA-AES128-GCM-SHA256       ECDH 256   AESGCM    128       
 xc027   ECDHE-RSA-AES128-SHA256           ECDH 256   AES       128       
 xc013   ECDHE-RSA-AES128-SHA              ECDH 256   AES       128       
 x9e     DHE-RSA-AES128-GCM-SHA256         DH 2048    AESGCM    128       
 x67     DHE-RSA-AES128-SHA256             DH 2048    AES       128       
 x33     DHE-RSA-AES128-SHA                DH 2048    AES       128       
 x9c     AES128-GCM-SHA256                 RSA        AESGCM    128       
 x3c     AES128-SHA256                     RSA        AES       128       
 x2f     AES128-SHA                        RSA        AES       128       

I can't specify RSA as a disabled cipher, because it will remove RSA from authentication list as well - not only key exchange.

How can I achieve PFS via a JVM level property/config? I'm running both the client and server in the same machine with Java 1.8.0_111

3

It's possible to enforce Forward Secrecy by listing all cipher suites that the Qualys SSLtest calls "weak" at jdk.tls.disabledAlgorithms in java.security. See Bart Mortelmans' answer at https://stackoverflow.com/questions/41237075/disabling-specific-weak-ciphers-and-enforcing-perfect-forward-secrecy-using-jvm.

I ended up with this:

[root@dolphin12 ~]# grep ^jdk.tls.dis -A6 /usr/lib/jvm/java/jre/lib/security/java.security
jdk.tls.disabledAlgorithms=SSLv2Hello, SSLv3, TLSv1, TLSv1.1, DES, DESede, RC4, MD5withRSA, DH keySize < 1024, \
    EC keySize < 224, DES40_CBC, RC4_40, \
    TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, \
    TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA, \
    TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_AES_128_GCM_SHA256, \
    TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, \
    TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA

There may be some inefficient, unnecessary or double things in there but it gives me an A grade and it also stopped the Chrome security tool from complaining about AES_256_CBC with HMAC-SHA1, which it calls "an obsolete cipher".

1

All the cipher suites you offer provide PFS because these all are DHE and ECDHE cipher suites. The RSA in DHE_RSA_WITH_AES_128_CBC_SHA only specifies that RSA is used for authentication. But DHE is used for key exchange which is the important part with PFS.

Apart from that: you still allow a DH key size of 768 bit which is considered weak. Use at least 1024 bit but better 2048 for DH.

  • My concern was Oracle's blog mentioning PFS requires cipher suites that start with "TLS_". Shouldn't I be concerned about that? Thanks for the recommendation on DH key size! – drox Dec 20 '16 at 11:41
  • 1
    @drox: DHE_RSA_WITH_AES_128_CBC_SHA is actually a short name for TLS_DHE_RSA_WITH_AES_128_CBC_SHA. No idea why the tool you use to check sometimes prints some ciphers with TLS in front and some not. – Steffen Ullrich Dec 20 '16 at 12:32
  • I have updated the question after further testing. – drox Dec 21 '16 at 5:58
  • @drox: unfortunately I can find no useful documentation which settings are possible through JDK properties. You might try to disable the full cipher but I'm not sure if this works. Apart from that there might simply be now way to do this via properties. – Steffen Ullrich Dec 21 '16 at 6:22
  • 1
    In fact I tried disabling RSA and got this "127.0.0.1:8243 doesn't seem to be a TLS/SSL enabled server" ;) Appreciate your help provided. Maybe I should post this in stackoverflow since it's a programming language specific question. – drox Dec 21 '16 at 6:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.