[EMAIL PROTECTED] writes:
> We'd like to have our config tool build this directive, but nobody can seem
> to figure this directive out. The config tool would have checkboxes like:
>
> [ ] 40 DES w/ SHA
> [ ] 56 DES w/ SHA
> [ ] 3DES w/ SHA
>
> [ ] 40 RC4 w/ MD5
> [ ] 64 RC4 w/ MD5
> [ ] 128 RC4 w/ MD5
> [ ] 128 RC4 w/ SHA
>
> [ ] NULL w/ SHA
> [ ] NULL w/ MD5
The way I had initially interpreted
http://www.modssl.org/docs/2.3/ssl_reference.html#ToC9 I had thought that
the SSLCipherSuite had to be built using +kRSA, +eNULL, +DES, +RC4,
etc. And that something like EXP-DES-CBC-SHA was simply the output of the
'ciphers' command. But as it turns out, what I had thought was simply the
output of the 'ciphers' command can actually be used as the *input*.
I took a look at ssl/ssl_ciph.c:ssl_create_cipher_list() but, umm, only
briefly, so I'm taking the output of the 'ciphers' command to mean I did
this correctly.
I did promise I'd share my findings. So here's what I came up with if
anybody is interested.
./openssl version
OpenSSL 0.9.2b 22 Mar 1999
[ 1] 40 bit DES w/ SHA only : EXP-DES-CBC-SHA
./openssl ciphers -v 'EXP-DES-CBC-SHA'
EXP-DES-CBC-SHA SSLv3 Kx=RSA(512) Au=RSA Enc=DES(40) Mac=SHA1 export
[ 2] 54 bit DES w/ SHA only : DES-CBC-SHA
./openssl ciphers -v 'DES-CBC-SHA'
DES-CBC-SHA SSLv3 Kx=RSA Au=RSA Enc=DES(56) Mac=SHA1
[ 3] both 1 and 2 : EXP-DES-CBC-SHA:DES-CBC-SHA
./openssl ciphers -v 'EXP-DES-CBC-SHA:DES-CBC-SHA'
EXP-DES-CBC-SHA SSLv3 Kx=RSA(512) Au=RSA Enc=DES(40) Mac=SHA1 export
[ 4] 3DES w/ SHA : DES-CBC3-SHA
./openssl ciphers -v 'DES-CBC3-SHA'
DES-CBC3-SHA SSLv3 Kx=RSA Au=RSA Enc=3DES(168) Mac=SHA1
How OpenSSL handles the RC4 ciphers is a bit odd. The 64 bit version is
always included with the 'export' and 128 bit version. So it must be
explicitly removed when only the 'export' or 128 bit version is required.
[ 5] 40 bit RC4 w/ MD5 only : EXP-RC4-MD5:-RC4-64-MD5
./openssl ciphers -v 'EXP-RC4-MD5:-RC4-64-MD5'
EXP-RC4-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export
EXP-RC4-MD5 SSLv2 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export
[ 6] 64 bit RC4 w/ MD5 only : RC4-64-MD5
./openssl ciphers -v 'RC4-64-MD5'
RC4-64-MD5 SSLv2 Kx=RSA Au=RSA Enc=RC4(64) Mac=MD5
[ 7] 128 bit RC4 w/ MD5 only : RC4-MD5:-RC4-64-MD5
./openssl ciphers -v 'RC4-MD5:-RC4-64-MD5'
RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5
RC4-MD5 SSLv2 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5
[ 8] 5 and 6 : EXP-RC4-MD5
./openssl ciphers -v 'EXP-RC4-MD5'
EXP-RC4-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export
RC4-64-MD5 SSLv2 Kx=RSA Au=RSA Enc=RC4(64) Mac=MD5
EXP-RC4-MD5 SSLv2 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export
[ 9] 5 and 7 : EXP-RC4-MD5:RC4-MD5:-RC4-64-MD5
./openssl ciphers -v 'EXP-RC4-MD5:RC4-MD5:-RC4-64-MD5'
EXP-RC4-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export
EXP-RC4-MD5 SSLv2 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export
RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5
RC4-MD5 SSLv2 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5
[10] 6 and 7 : RC4-MD5
./openssl ciphers -v 'RC4-MD5'
RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5
RC4-64-MD5 SSLv2 Kx=RSA Au=RSA Enc=RC4(64) Mac=MD5
RC4-MD5 SSLv2 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5
[11] 5 and 6 and 7 : EXP-RC4-MD5:RC4-MD5
./openssl ciphers -v 'EXP-RC4-MD5:RC4-MD5'
EXP-RC4-MD5 SSLv3 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export
RC4-64-MD5 SSLv2 Kx=RSA Au=RSA Enc=RC4(64) Mac=MD5
EXP-RC4-MD5 SSLv2 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export
RC4-MD5 SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5
RC4-MD5 SSLv2 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5
[12] 128 bit RC4 w/ SHA only : RC4-SHA
./openssl ciphers -v 'RC4-SHA'
RC4-SHA SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1
[13] NULL with MD5 : NULL-MD5
./openssl ciphers -v 'NULL-MD5'
NULL-MD5 SSLv3 Kx=RSA Au=RSA Enc=None Mac=MD5
[14] NULL with SHA : NULL-SHA
./openssl ciphers -v 'NULL-SHA'
NULL-SHA SSLv3 Kx=RSA Au=RSA Enc=None Mac=SHA1
-Tom
--
Tom Vaughan <tvaughan at aventail dot com>
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
