Our security audit report says that a number of our JBoss EAP 5.0 servers (on RHEL 6.x) has weak ciphers enabled. Upon doing some research, I found a
.jar file (from https://access.redhat.com/solutions/18405) which, when run from the server, lists the default and supported cipher suites. I ran the
.jar file obtained the following output under default cipher suites section:
DefaultCipherSuites: SSL_RSA_WITH_RC4_128_MD5 SSL_RSA_WITH_RC4_128_SHA TLS_RSA_WITH_AES_128_CBC_SHA TLS_RSA_WITH_AES_256_CBC_SHA TLS_DHE_RSA_WITH_AES_128_CBC_SHA TLS_DHE_RSA_WITH_AES_256_CBC_SHA TLS_DHE_DSS_WITH_AES_128_CBC_SHA TLS_DHE_DSS_WITH_AES_256_CBC_SHA SSL_RSA_WITH_3DES_EDE_CBC_SHA SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA SSL_RSA_WITH_DES_CBC_SHA SSL_DHE_RSA_WITH_DES_CBC_SHA SSL_DHE_DSS_WITH_DES_CBC_SHA SSL_RSA_EXPORT_WITH_RC4_40_MD5 SSL_RSA_EXPORT_WITH_DES40_CBC_SHA SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA TLS_EMPTY_RENEGOTIATION_INFO_SCSV
I understand that weak ciphers are the ones that has its key length less than 128 bits. And that out of all the ciphers listed above:
- The ones that contain '128' in its name indicates ciphers with a key-length of 128.
- The ones that contain '256' provides 256 bit encryption.
- The ones that has 'DES' are DES keys with 56 bit encryption.
- The ones with 'RC4_40' means 40 bit encryption.
- The ones with 'DES40' means 40 bit encryption again.
- The ones with '3DES' means triple-DES with 128/192 key encryption.
I'm aware of how to edit the SSL/TLS Connector block in
server.xml to enable only some of the cipher suites.
Now my questions are:
Is my understanding about the relationship between the cipher names and the bit lengths they support are correct?
If the answer for my question # 1 is 'yes', then, does 'disabling all the weak ciphers' mean removing/disabling all the ciphers that has DES, RC4_40 and DES40 in their names?
What is the key length of TLS_EMPTY_RENEGOTIATION_INFO_SCSV?