I have an application which uses SSL (JSSE Implementation). Currently from my client side, the "Client Hello" message suggests a list of cipher suites that consists of both 128 & 256 bits key length encryption algorithm ( e.g. Cipher Suites:
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a), TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013) )
I want to filter out cipher suites which use AES 128 bits key length in the Client Hello message so I put this line in java.security file of client side
jdk.tls.disabledAlgorithms=DSA, RSA keySize < 2048, AES keySize < 256
However it does not work. Cipher suites like
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA are still there in the Client Hello message.
If I configure the parameter like this:
jdk.tls.disabledAlgorithms=DSA, RSA keySize < 2048, AES
then all the cipher suites which use AES encryption algorithm will be disabled.
I don't understand why the
keySize constraint does not work in my case.