Re: SSL/TLS encryption algorithms
On 03.11.2013 18:27, Viktor Dukhovni wrote: On Sun, Nov 03, 2013 at 06:18:38PM +0100, Walter H. wrote: how would I define forward-secrecy on Apache webserver? If the server negotiated both ciphers, it already supports forward-secrecy (aka PFS) if the client does too. What about a browser that shows this SSL_CIPHER=RC4-MD5 SSL_CIPHER_ALGKEYSIZE=128 SSL_CIPHER_EXPORT=false SSL_CIPHER_USEKEYSIZE=128 SSL_COMPRESS_METHOD=NULL SSL_PROTOCOL=TLSv1 SSL_SECURE_RENEG=true Your server supports PFS, some browsers don't. Or prefer non-PFS cipher-suites to PFS. Default settings of OpenSSL 1.0.0 or later have sensibly ordered ciphersuites. Sufficiently recent versions of Apache enable EDH/EECDH (aka PFS) cipher-suites by setting appropriate parameters ((p,g) pairs or named curves). Ok, I understand; how good is this encryption in comparison to the other two I mentioned before? what does SSL_SECURE_RENEG say to me? some browsers show true, some show false ... Thanks, Walter __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: SSL/TLS encryption algorithms
On Sun, Nov 03, 2013 at 06:18:38PM +0100, Walter H. wrote: > > >how would I define forward-secrecy on Apache webserver? > > > > If the server negotiated both ciphers, it already supports > > forward-secrecy (aka PFS) if the client does too. > > What about a browser that shows this > > SSL_CIPHER=RC4-MD5 > SSL_CIPHER_ALGKEYSIZE=128 > SSL_CIPHER_EXPORT=false > SSL_CIPHER_USEKEYSIZE=128 > SSL_COMPRESS_METHOD=NULL > SSL_PROTOCOL=TLSv1 > SSL_SECURE_RENEG=true Your server supports PFS, some browsers don't. Or prefer non-PFS cipher-suites to PFS. Default settings of OpenSSL 1.0.0 or later have sensibly ordered ciphersuites. Sufficiently recent versions of Apache enable EDH/EECDH (aka PFS) cipher-suites by setting appropriate parameters ((p,g) pairs or named curves). -- Viktor. __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: SSL/TLS encryption algorithms
On 01.11.2013 23:12, Viktor Dukhovni wrote: $ openssl ciphers -v DHE-RSA-CAMELLIA256-SHA DHE-RSA-CAMELLIA256-SHA SSLv3 Kx=DH Au=RSA Enc=Camellia(256) Mac=SHA1 $ openssl ciphers -v AES128-SHA256 AES128-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA256 Does your application need to perform faster, offer forward-secrecy, be most interoperable, ... ? these was the result of using 2 different browsers with the same SSL website ... (1) an old firefox (2) the latest IE - IE11 on Win 8.1 https://ssl.mathemainzel.info/info/ you can try your browser ... how would I define forward-secrecy on Apache webserver? If the server negotiated both ciphers, it already supports forward-secrecy (aka PFS) if the client does too. What about a browser that shows this SSL_CIPHER=RC4-MD5 SSL_CIPHER_ALGKEYSIZE=128 SSL_CIPHER_EXPORT=false SSL_CIPHER_USEKEYSIZE=128 SSL_COMPRESS_METHOD=NULL SSL_PROTOCOL=TLSv1 SSL_SECURE_RENEG=true Thanks, Walter __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: DTLS PSK in FIPS mode
On Fri, Oct 25, 2013, Fredrik Jansson wrote: > > I am trying to use DTLS with PSK (cipher: SSL_TXT_PSK). Everything works > well if I don't set OpenSSL in FIPS mode (FIPS_mode_set(1)). > Can you reproduce this using s_client and s_server? If so can you give details of the command lines you used? Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
