4

As we all know all EXPORT ciphers in OpenSSL should be disabled so that we are not vulnerable to the FREAK attack.

reference-

http://blog.cryptographyengineering.com/2015/03/attack-of-week-freak-or-factoring-nsa.html

I am using the string "kEDH:ALL:!ADH:!DES:!LOW:!EXPORT40:+SSLv2:@STRENGTH" with SSL_CTX_set_cipher_list() which disables EXPORT40 or export ciphers of 40-bit key length.

Also, Export56 is disabled by default from OpenSSL 0.9.8c and disables export ciphers of 56-bit key length

How do I disable other EXPORT ciphers which are part of TLS v1.0 and 'Export 1024' ciphers?

  • Looks like all EXPOR ciphers which are part of TLSv1.0 have 40bit key length and hence may have been disabled by !EXPORT40 – user49149 Mar 6 '15 at 9:25
  • I am guessing using !EXPORT should disable all the EXPORT ciphers .. Can anyone please confirm? – user49149 Mar 6 '15 at 9:27
  • Additional recommendations: !LOW already excludes all DES, and as noted EXPORT40 are the only EXPORT. On 1.0.0+ if you put kEDH first for PFS you should do kEECDH also, and if you excluded !ADH for safety you should exclude !AECDH also or more simply just !aNULL does both. Unless you actually need SSLv2 which I hope not, you should !SSLv2 instead of +, especially on client because if code uses the generic "v23" method without OP_NO_version flags, enabling any v2 ciphers uses the highly undesirable v2 Hello format. – dave_thompson_085 Jun 21 '15 at 5:57
0

you can add !EXPORT in place to :!EXPORT40 it will disable all export cipher

this link may provide much more information about Freak & Export cipher http://openssl.6102.n7.nabble.com/openssl-users-How-to-disable-all-EXPORT-Ciphers-td56861.html

0

Only the original 40-bit EXPORT ciphers are affected by the attack anyway. It is unfortunate that OpenSSL disabled the 56-bit EXPORT1024 ciphers back in 2006. And yes these are the only two categories of EXPORT ciphers in SSL/TLS.

  • Is it possible to amend this answer so that it includes the OpenSSL specific configuration required? – Maarten Bodewes Mar 10 '15 at 12:41
  • append !EXPORT to the string which is passed on to SSL_CTX_set_cipher_list(). This should exclude all EXPORT ciphers – user49149 Apr 21 '15 at 15:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.