1

Our security audit report says that a number of our JBoss EAP 5.0 servers (on RHEL 6.x) has weak ciphers enabled. Upon doing some research, I found a .jar file (from https://access.redhat.com/solutions/18405) which, when run from the server, lists the default and supported cipher suites. I ran the .jar file obtained the following output under default cipher suites section:

DefaultCipherSuites:

SSL_RSA_WITH_RC4_128_MD5
SSL_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
TLS_DHE_RSA_WITH_AES_128_CBC_SHA
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_DHE_DSS_WITH_AES_128_CBC_SHA
TLS_DHE_DSS_WITH_AES_256_CBC_SHA 
SSL_RSA_WITH_3DES_EDE_CBC_SHA 
SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
SSL_RSA_WITH_DES_CBC_SHA
SSL_DHE_RSA_WITH_DES_CBC_SHA
SSL_DHE_DSS_WITH_DES_CBC_SHA
SSL_RSA_EXPORT_WITH_RC4_40_MD5
SSL_RSA_EXPORT_WITH_DES40_CBC_SHA
SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA
SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA
TLS_EMPTY_RENEGOTIATION_INFO_SCSV

I understand that weak ciphers are the ones that has its key length less than 128 bits. And that out of all the ciphers listed above:

  • The ones that contain '128' in its name indicates ciphers with a key-length of 128.
  • The ones that contain '256' provides 256 bit encryption.
  • The ones that has 'DES' are DES keys with 56 bit encryption.
  • The ones with 'RC4_40' means 40 bit encryption.
  • The ones with 'DES40' means 40 bit encryption again.
  • The ones with '3DES' means triple-DES with 128/192 key encryption.

I'm aware of how to edit the SSL/TLS Connector block in server.xml to enable only some of the cipher suites.

Now my questions are:

  1. Is my understanding about the relationship between the cipher names and the bit lengths they support are correct?

  2. If the answer for my question # 1 is 'yes', then, does 'disabling all the weak ciphers' mean removing/disabling all the ciphers that has DES, RC4_40 and DES40 in their names?

  3. What is the key length of TLS_EMPTY_RENEGOTIATION_INFO_SCSV?

  • 1
    'Weak' cipher is a very subjective point of view. For banking transactions any SSL (non-TLS) cipher would be considered weak, but for viewing your personalized TV-guide it would be ok. I think it's best if you ask your auditor or security officer what ciphers they consider weak. – mtak Oct 13 '14 at 15:11
  • Thanks mtak. The auditor considers all ciphers with length less than 128 bit to be weak. – Sree Oct 13 '14 at 15:15
  • 1
    I would not rely on that to determine the strength of the key. Take a look at the Cipher Suite wikipeidia pg: en.wikipedia.org/wiki/Cipher_suite as well as my blog article about SSLv2 vs. SSLv3 cipher suites: lamolabs.org/blog/225/locking-down-sslv2-in-apache/#more-225, also read the docs covered her on ssllabs: ssllabs.com/projects/documentation – slm Oct 13 '14 at 16:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.