How to enforce Perfect Forward Secrecy using JVM properties?

Question

According to this blogpost Perfect Forward Secrecy (PFS) is provided by:

Anything on the Algorithm Standard Name list that start with TLS (Transport Level Security) followed by a type of DHE (Diffie-Hellman Exchange).

E.g. TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA

I want to achieve this by using Java's 'jdk.tls.disabledAlgorithms' property in java.security file. Right now I have the following values for that property:

jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, RC4, MD5, DESede, DH keySize < 768, RSA keySize < 2048

And following is the result by TestSSLServer:

$ java -jar TestSSLServer.jar 127.0.0.1 9443
Supported versions: TLSv1.2
Deflate compression: no
Supported cipher suites (ORDER IS NOT SIGNIFICANT):
  TLSv1.2
     DHE_RSA_WITH_AES_128_CBC_SHA
     DHE_RSA_WITH_AES_256_CBC_SHA
     DHE_RSA_WITH_AES_128_CBC_SHA256
     DHE_RSA_WITH_AES_256_CBC_SHA256
     TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
     TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
     TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
     TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
     TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
     TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
     TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
     TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
----------------------
Server certificate(s):
  xxxxx
----------------------
Minimal encryption strength:     strong encryption (96-bit or more)
Achievable encryption strength:  strong encryption (96-bit or more)
BEAST status: protected
CRIME status: protected

I still couldn't find a mechanism to get rid of suites that don't provide PFS. E.g. 'DHE_RSA_WITH_AES_128_CBC_SHA'.

Can we get this done by 'jdk.tls.disabledAlgorithms'? If not, is there any other JVM level mechanism?

UPDATE:

After @Steffen confirmed that all my previous listed ciphers provided PFS, I tested again with another server and can see RSA getting listed as a key exchange algorithm. This time tried with 2 tools - both recommended by OWASP

jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, RC4, MD5, DESede, RSA keySize < 2048

NOTE: Setting 'DH keySize < 2048' using this property didn't have any effect. I had to use the system property "-Djdk.tls.ephemeralDHKeySize=2048" to increase the DH key size as recommended by @Steffen.

TestSSLServer

Supported cipher suites (ORDER IS NOT SIGNIFICANT):
  TLSv1.2
     RSA_WITH_AES_128_CBC_SHA
     DHE_RSA_WITH_AES_128_CBC_SHA
     RSA_WITH_AES_256_CBC_SHA
     DHE_RSA_WITH_AES_256_CBC_SHA
     RSA_WITH_AES_128_CBC_SHA256
     RSA_WITH_AES_256_CBC_SHA256
     DHE_RSA_WITH_AES_128_CBC_SHA256
     DHE_RSA_WITH_AES_256_CBC_SHA256
     TLS_RSA_WITH_AES_128_GCM_SHA256
     TLS_RSA_WITH_AES_256_GCM_SHA384
     TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
     TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
     TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
     TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
     TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
     TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
     TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
     TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

testssl.sh

Testing all 124 locally available ciphers against the server, ordered by encryption strength 

Hexcode  Cipher Suite Name (OpenSSL)       KeyExch.  Encryption Bits
------------------------------------------------------------------------
 xc030   ECDHE-RSA-AES256-GCM-SHA384       ECDH 256   AESGCM    256       
 xc028   ECDHE-RSA-AES256-SHA384           ECDH 256   AES       256       
 xc014   ECDHE-RSA-AES256-SHA              ECDH 256   AES       256       
 x9f     DHE-RSA-AES256-GCM-SHA384         DH 2048    AESGCM    256       
 x6b     DHE-RSA-AES256-SHA256             DH 2048    AES       256       
 x39     DHE-RSA-AES256-SHA                DH 2048    AES       256       
 x9d     AES256-GCM-SHA384                 RSA        AESGCM    256       
 x3d     AES256-SHA256                     RSA        AES       256       
 x35     AES256-SHA                        RSA        AES       256       
 xc02f   ECDHE-RSA-AES128-GCM-SHA256       ECDH 256   AESGCM    128       
 xc027   ECDHE-RSA-AES128-SHA256           ECDH 256   AES       128       
 xc013   ECDHE-RSA-AES128-SHA              ECDH 256   AES       128       
 x9e     DHE-RSA-AES128-GCM-SHA256         DH 2048    AESGCM    128       
 x67     DHE-RSA-AES128-SHA256             DH 2048    AES       128       
 x33     DHE-RSA-AES128-SHA                DH 2048    AES       128       
 x9c     AES128-GCM-SHA256                 RSA        AESGCM    128       
 x3c     AES128-SHA256                     RSA        AES       128       
 x2f     AES128-SHA                        RSA        AES       128       

I can't specify RSA as a disabled cipher, because it will remove RSA from authentication list as well - not only key exchange.

How can I achieve PFS via a JVM level property/config? I'm running both the client and server in the same machine with Java 1.8.0_111

Answer 1

It's possible to enforce Forward Secrecy by listing all cipher suites that the Qualys SSLtest calls "weak" at jdk.tls.disabledAlgorithms in java.security. See Bart Mortelmans' answer at https://stackoverflow.com/questions/41237075/disabling-specific-weak-ciphers-and-enforcing-perfect-forward-secrecy-using-jvm.

I ended up with this:

[root@dolphin12 ~]# grep ^jdk.tls.dis -A6 /usr/lib/jvm/java/jre/lib/security/java.security
jdk.tls.disabledAlgorithms=SSLv2Hello, SSLv3, TLSv1, TLSv1.1, DES, DESede, RC4, MD5withRSA, DH keySize < 1024, \
    EC keySize < 224, DES40_CBC, RC4_40, \
    TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, \
    TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA, \
    TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_AES_128_GCM_SHA256, \
    TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, \
    TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA

There may be some inefficient, unnecessary or double things in there but it gives me an A grade and it also stopped the Chrome security tool from complaining about AES_256_CBC with HMAC-SHA1, which it calls "an obsolete cipher".

Answer 2

All the cipher suites you offer provide PFS because these all are DHE and ECDHE cipher suites. The RSA in DHE_RSA_WITH_AES_128_CBC_SHA only specifies that RSA is used for authentication. But DHE is used for key exchange which is the important part with PFS.

Apart from that: you still allow a DH key size of 768 bit which is considered weak. Use at least 1024 bit but better 2048 for DH.