disable weak ciphers in SSL connection

ssl cryptography openssl elliptic-curve
Ravi picture Ravi · Sep 23, 2010 · Viewed 44.3k times · Source

I am using the function SSL_CTX_set_cipher_list to set the ciphers supported for the SSL connection. What argument to pass to SSL_CTX_set_cipher_list to disable weak ciphers.

I tried passing ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH

but it doesn't seem to work.

My tool to detect weak cipher reports for the following as enabled still

** SSLv3:DES-CBC-SHA - ENABLED - WEAK 56 bits **

** TLSv1:DES-CBC-SHA - ENABLED - WEAK 56 bits **

** SSLv2:RC4-MD5 - ENABLED - WEAK 128 bits **
** SSLv2:RC2-CBC-MD5 - ENABLED - WEAK 128 bits **
** SSLv2:RC4-64-MD5 - ENABLED - WEAK 64 bits **
** SSLv2:DES-CBC-MD5 - ENABLED - WEAK 56 bits **
** SSLv2:EXP-RC4-MD5 - ENABLED - WEAK 40 bits **
** SSLv2:EXP-RC2-CBC-MD5 - ENABLED - WEAK 40 bits **
** SSLv2:DES-CBC3-MD5 - ENABLED - WEAK 168 bits **

What argument to pass to SSL_CTX_set_cipher_list to disable the above ciphers?

Answer

Gerhard Schlager picture Gerhard Schlager · Sep 23, 2010

HIGH:!DSS:!aNULL@STRENGTH should work.

openssl ciphers -v 'HIGH:!DSS:!aNULL@STRENGTH' prints the following list of ciphers:

DHE-RSA-AES256-SHA      SSLv3 Kx=DH       Au=RSA  Enc=AES(256)  Mac=SHA1
AES256-SHA              SSLv3 Kx=RSA      Au=RSA  Enc=AES(256)  Mac=SHA1
EDH-RSA-DES-CBC3-SHA    SSLv3 Kx=DH       Au=RSA  Enc=3DES(168) Mac=SHA1
DES-CBC3-SHA            SSLv3 Kx=RSA      Au=RSA  Enc=3DES(168) Mac=SHA1
DES-CBC3-MD5            SSLv2 Kx=RSA      Au=RSA  Enc=3DES(168) Mac=MD5
DHE-RSA-AES128-SHA      SSLv3 Kx=DH       Au=RSA  Enc=AES(128)  Mac=SHA1
AES128-SHA              SSLv3 Kx=RSA      Au=RSA  Enc=AES(128)  Mac=SHA1

For a complete list of OpenSSL cipher strings and their meaning take a look at: http://www.openssl.org/docs/apps/ciphers.html

Related questions

How to use .key and .crt file in java that generated by openssl?

I need asymmetric encryption in java. I generate .key and .crt files with own password and .crt file by openssl that said in http://www.imacat.idv.tw/tech/sslcerts.html . How to use these .key and .crt file to …

Read More
How to verify a signed file in python

Background I have signed a file using openssl SHA256 and a private key as follows: with subprocess.Popen( # Pipe the signature to openssl to convert it from raw binary encoding to base64 encoding. # This will prevent any potential corruption due …

Read More
Why does SSL handshake give 'Could not generate DH keypair' exception?

When I make an SSL connection with some IRC servers (but not others - presumably due to the server's preferred encryption method) I get the following exception: Caused by: java.lang.RuntimeException: Could not generate DH keypair at com.sun.…

Read More