Hardening your Web Server's SSL Ciphers

#1

Post by roguelynn » Tue, Feb 05, 2013, 3:52 PM UTC

Hardening your Web Server's SSL Ciphers
hynek.me

Re: Hardening your Web Server's SSL Ciphers

#2

Post by hn-miw-i » Tue, Feb 05, 2013, 4:12 PM UTC

Don't know if I agree re RC4; BEAST is an issue with CBC, not AES. AES-GCM should be ok, if not superior to the ancient RC4.

Re: Hardening your Web Server's SSL Ciphers

#3

Post by hynek » Tue, Feb 05, 2013, 4:16 PM UTC

hn-miw-i wrote: post #2

Don't know if I agree re RC4; BEAST is an issue with CBC, not AES. AES-GCM should be ok, if not superior to the ancient RC4.

RC4 has no known practicably exploitable weaknesses and is well supported, insofar the “ancient” is actually working in its favor.

That said, if you know as much as you do, you don’t need that article and can fine tune yourself. It’s for people who want a compatible and secure SSL setup – which it is.

Re: Hardening your Web Server's SSL Ciphers

#4

Post by dfc » Tue, Feb 05, 2013, 4:52 PM UTC

Take a look at applebaum's duraconf. It has configs for many ssl/tls services:

https://github.com/ioerror/duraconf

Re: Hardening your Web Server's SSL Ciphers

#5

Post by thirsteh » Tue, Feb 05, 2013, 4:58 PM UTC

hynek wrote: post #3

hn-miw-i wrote: post #2

Don't know if I agree re RC4; BEAST is an issue with CBC, not AES. AES-GCM should be ok, if not superior to the ancient RC4.

RC4 has no known practicably exploitable weaknesses and is well supported, insofar the “ancient” is actually working in its favor. That said, if you know as much as you do, you don’t need that article and can fine tune yourself. It’s for people who want a compatible and secure SSL setup – which it is.

The statement that RC4 has no weaknesses is not true. It has well-known biases: http://en.wikipedia.org/wiki/RC4#Security It is just better than CBC (as implemented), being a stream cipher, and thus using RC4 is the best solution right now. It is still important to get as much as possible up to TLS 1.2 and using AES-GCM or other AEAD modes as soon as possible.

Edit: Clarified that RC4 is better than CBC as implemented, not CBC implemented with constant-time verification, i.e. RC4 will not be preferable to AES-CBC in the fixed version of OpenSSL, at least against the Lucky Thirteen attack.

Re: Hardening your Web Server's SSL Ciphers

#6

Post by hynek » Tue, Feb 05, 2013, 5:03 PM UTC

thirsteh wrote: post #5

hynek wrote: post #3

Earlier quoted context omitted.

RC4 has no known practicably exploitable weaknesses and is well supported, insofar the “ancient” is actually working in its favor. That said, if you know as much as you do, you don’t need that article and can fine tune yourself. It’s for people who want a compatible and secure SSL setup – which it is.

The statement that RC4 has no weaknesses is not true. It has well-known biases: http://en.wikipedia.org/wiki/RC4#Security It is just better than CBC (as implemented), being a stream cipher, and thus using RC4 is the best solution right now. It is still important to get as much as possible up to TLS 1.2 and using AES-GCM or other AEAD modes as soon as possible. Edit: Clarified that RC4 is better than CBC as implemente…

Absolutely. But since we still have to support SSLv3 from 1996, I wouldn’t hold my breath. :(

Re: Hardening your Web Server's SSL Ciphers

#7

Post by hynek » Tue, Feb 05, 2013, 5:03 PM UTC

dfc wrote: post #4

Take a look at applebaum's duraconf. It has configs for many ssl/tls services: https://github.com/ioerror/duraconf

Thanks, I’ve added it to the article.

Re: Hardening your Web Server's SSL Ciphers

#8

Post by thirsteh » Tue, Feb 05, 2013, 5:05 PM UTC

hynek wrote: post #6

thirsteh wrote: post #5

Earlier quoted context omitted.

The statement that RC4 has no weaknesses is not true. It has well-known biases: http://en.wikipedia.org/wiki/RC4#Security It is just better than CBC (as implemented), being a stream cipher, and thus using RC4 is the best solution right now. It is still important to get as much as possible up to TLS 1.2 and using AES-GCM or other AEAD modes as soon as possible. Edit: Clarified that RC4 is better than CBC as implemente…

Absolutely. But since we still have to support SSLv3 from 1996, I wouldn’t hold my breath. :(

Yeah. The outlook is not that great, and RC4 will definitely be better than CBC for those legacy systems in light of this discovery (http://www.isg.rhul.ac.uk/tls/). At least the browsers are actively working on supporting the latest TLS and modes.

Re: Hardening your Web Server's SSL Ciphers

#9

Post by dochtman » Tue, Feb 05, 2013, 5:05 PM UTC

I think this CipherSuite is actually better than what you have (and Qualys seems to think so, too):

SSLCipherSuite ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH

Also, I couldn't get your disabling of SSL compression to work (on Gentoo Linux), either by pasting the export line into /etc/conf.d/apache2 (at the end) or /etc/init.d/apache2 (at the top).

Re: Hardening your Web Server's SSL Ciphers

#10

Post by hynek » Tue, Feb 05, 2013, 5:11 PM UTC

dochtman wrote: post #9

I think this CipherSuite is actually better than what you have (and Qualys seems to think so, too): SSLCipherSuite ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH Also, I couldn't get your disabling of SSL compression to work (on Gentoo Linux), either by pasting the export line into /etc/conf.d/apache2 (at the end) or /etc/init.d/apache2 (at the top).

Yes, but some of the ciphers aren’t supported in widely used OpenSSL versions (like 0.9.8). I wanted to give people a configuration that works everywhere and is reasonable secure.

If they want more, there’s a link list at the end. Let’s not make perfect the enemy of the good.

Edit I’ve added an advanced section with a link to here so you get your credit. :)