Configuring GCM cipher suites in Jetty based server

Question

I have a Jetty based secure http service, and I wish to support GCM cipher suites. I know that Jetty internally use JSSE based ciphers, and there are many GCM ciphers coming with JSSE as documented here - http://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html#ciphersuites

However, I can't get Jetty to support any of these. For eg: I configure the below ones for Jetty

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

but are not listed as supported ciphers from an SSL scan.

I searched a lot, and also cannot figure out where to look for available JSSE ciphers in a distribution. Any help would be appreciated.

Answer 1

The document you are linking to lists only the standard cipher suite names; it does not promise that all these cipher suites are actually supported by any JSSE provider, in particular the one which comes with Java and is called SunJSSE. That the standard name TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 is defined just means that if a JSSE provider wants to provide support for that cipher suite, then it must provide it under that name.

This document, which allegedly pertains to Java 7 as well, lists the cipher suites which SunJSSE actually supports; some enabled by default, others disabled by default. I see no GCM cipher suite at all...

Support for GCM cipher suites may be added in a future version; you might want to try some previews of Java 8 (Java 8 release is due March 2014). In any case, GCM cipher suites in SSL require TLS 1.2 (they don't work with previous protocol versions), and the AES_256 is 256-bit AES which, with the cryptographic implementations provided with Java, requires the JCE Unlimited Strength Jurisdiction Policy Files (a remnant of the US export regulations on cryptographic material).