SSLCIPH (JANUS DEFINE parameter) - Revision history

JAL: remove displaytitle

2016-06-07T23:30:00Z

remove displaytitle

← Older revision		Revision as of 23:30, 7 June 2016
Line 1:		Line 1:
	~~{{DISPLAYTITLE:SSLCIPH}}~~
	<span class="pageSubtitle">SSLCIPH xxx — Limit SSL ciphers offered by this port</span>		<span class="pageSubtitle">SSLCIPH xxx — Limit SSL ciphers offered by this port</span>

JAL: link repair

2016-06-01T18:58:38Z

link repair

← Older revision		Revision as of 18:58, 1 June 2016
Line 5:		Line 5:
	<var>SSLCIPH</var> is a parameter on the <var>[[JANUS DEFINE]]</var> command, which defines and sets characteristics of a Janus port.		<var>SSLCIPH</var> is a parameter on the <var>[[JANUS DEFINE]]</var> command, which defines and sets characteristics of a Janus port.

	This parameter lets you limit the stream ciphers (encryption algorithms) that this port offers for SSL connections. A Janus port whose definition includes an <var>[[SSL (JANUS DEFINE parameter)\|SSL]]</var> parameter supports <var class="product">[[~~Media:JansslrNew.pdf\|Rocket M204~~ Janus Network Security]]</var> SSL (Secure Sockets Layer) or TLS (Transport Layer Security) encrypted connections.		This parameter lets you limit the stream ciphers (encryption algorithms) that this port offers for SSL connections. A Janus port whose definition includes an <var>[[SSL (JANUS DEFINE parameter)\|SSL]]</var> parameter supports <var class="product">[[Janus Network Security]]</var> SSL (Secure Sockets Layer) or TLS (Transport Layer Security) encrypted connections.

	Typically, <var>SSLCIPH</var> is allowed to default to 0: all the Janus-supported ciphers are available, and the cipher that is ultimately used depends on the outcome of the handshake negotiation with the client that seeks the service at this port. The negotiation selects the strongest available cipher that the client can support.		Typically, <var>SSLCIPH</var> is allowed to default to 0: all the Janus-supported ciphers are available, and the cipher that is ultimately used depends on the outcome of the handshake negotiation with the client that seeks the service at this port. The negotiation selects the strongest available cipher that the client can support.

JAL: misc formatting

2015-10-07T20:06:29Z

misc formatting

← Older revision		Revision as of 20:06, 7 October 2015
Line 9:		Line 9:
	Typically, <var>SSLCIPH</var> is allowed to default to 0: all the Janus-supported ciphers are available, and the cipher that is ultimately used depends on the outcome of the handshake negotiation with the client that seeks the service at this port. The negotiation selects the strongest available cipher that the client can support.		Typically, <var>SSLCIPH</var> is allowed to default to 0: all the Janus-supported ciphers are available, and the cipher that is ultimately used depends on the outcome of the handshake negotiation with the client that seeks the service at this port. The negotiation selects the strongest available cipher that the client can support.

	However, to make only a subset of the server ciphers available, you can specify <var>SSLCIPH</var> followed by the (bitmask) value that selects the subset. For example, <code>SSLCIPH 2</code> indicates that only strong RC4 encryption is available. It is probably a good idea to disable export ciphers (<~~var~~>SSLCIPH~~</var>=~~X'03F6'), since they are weakened by design. Also, given that the current preferred cipher is AES, it might make sense to set <var>SSLCIPH</var> to X'03C0' to force [http://en.wikipedia.org/wiki/Advanced_Encryption_Standard AES] bulk encryption.		However, to make only a subset of the server ciphers available, you can specify <var>SSLCIPH</var> followed by the (bitmask) value that selects the subset. For example, <code>SSLCIPH 2</code> indicates that only strong RC4 encryption is available. It is probably a good idea to disable export ciphers (<code>SSLCIPH X'03F6'</code>), since they are weakened by design. Also, given that the current preferred cipher is AES, it might make sense to set <var>SSLCIPH</var> to X'03C0' to force [http://en.wikipedia.org/wiki/Advanced_Encryption_Standard AES] bulk encryption.

	Currently, these ciphers are supported:		Currently, these ciphers are supported:

JAL: link repair

2015-03-09T15:33:52Z

link repair

← Older revision		Revision as of 15:33, 9 March 2015
Line 5:		Line 5:
	<var>SSLCIPH</var> is a parameter on the <var>[[JANUS DEFINE]]</var> command, which defines and sets characteristics of a Janus port.		<var>SSLCIPH</var> is a parameter on the <var>[[JANUS DEFINE]]</var> command, which defines and sets characteristics of a Janus port.

	This parameter lets you limit the stream ciphers (encryption algorithms) that this port offers for SSL connections. A Janus port whose definition includes an <var>[[SSL (JANUS DEFINE parameter)\|SSL]]</var> parameter supports <var class="product">[~~http~~:~~//m204wiki.rocketsoftware.com/images/d/de/~~JansslrNew.pdf Rocket M204 Janus Network Security]</var> SSL (Secure Sockets Layer) or TLS (Transport Layer Security) encrypted connections.		This parameter lets you limit the stream ciphers (encryption algorithms) that this port offers for SSL connections. A Janus port whose definition includes an <var>[[SSL (JANUS DEFINE parameter)\|SSL]]</var> parameter supports <var class="product">[[Media:JansslrNew.pdf\|Rocket M204 Janus Network Security]]</var> SSL (Secure Sockets Layer) or TLS (Transport Layer Security) encrypted connections.

	Typically, <var>SSLCIPH</var> is allowed to default to 0: all the Janus-supported ciphers are available, and the cipher that is ultimately used depends on the outcome of the handshake negotiation with the client that seeks the service at this port. The negotiation selects the strongest available cipher that the client can support.		Typically, <var>SSLCIPH</var> is allowed to default to 0: all the Janus-supported ciphers are available, and the cipher that is ultimately used depends on the outcome of the handshake negotiation with the client that seeks the service at this port. The negotiation selects the strongest available cipher that the client can support.

	However, to make only a subset of the server ciphers available, you can specify <var>SSLCIPH</var> followed by the (bitmask) value that selects the subset. For example, <code>SSLCIPH 2</code> indicates that only strong RC4 encryption is available. It is probably a good idea to disable export ciphers (<var>SSLCIPH</var>=X'03F6') as they are weakened by design, ~~and~~ given that the current preferred cipher is AES, it might make sense to set <var>SSLCIPH</var> to X'03C0' to force [http://en.wikipedia.org/wiki/Advanced_Encryption_Standard AES] bulk encryption.		However, to make only a subset of the server ciphers available, you can specify <var>SSLCIPH</var> followed by the (bitmask) value that selects the subset. For example, <code>SSLCIPH 2</code> indicates that only strong RC4 encryption is available. It is probably a good idea to disable export ciphers (<var>SSLCIPH</var>=X'03F6'), since they are weakened by design. Also, given that the current preferred cipher is AES, it might make sense to set <var>SSLCIPH</var> to X'03C0' to force [http://en.wikipedia.org/wiki/Advanced_Encryption_Standard AES] bulk encryption.


	Currently, these ciphers are supported:		Currently, these ciphers are supported:

JDamon: Small change to description of disabling export ciphers.

2015-01-06T00:06:28Z

Small change to description of disabling export ciphers.

← Older revision		Revision as of 00:06, 6 January 2015
Line 9:		Line 9:
	Typically, <var>SSLCIPH</var> is allowed to default to 0: all the Janus-supported ciphers are available, and the cipher that is ultimately used depends on the outcome of the handshake negotiation with the client that seeks the service at this port. The negotiation selects the strongest available cipher that the client can support.		Typically, <var>SSLCIPH</var> is allowed to default to 0: all the Janus-supported ciphers are available, and the cipher that is ultimately used depends on the outcome of the handshake negotiation with the client that seeks the service at this port. The negotiation selects the strongest available cipher that the client can support.

	However, to make only a subset of the server ciphers available, you can specify <var>SSLCIPH</var> followed by the (bitmask) value that selects the subset. For example, <code>SSLCIPH 2</code> indicates that only strong RC4 encryption is available. It is probably a good idea to disable export ciphers as they are weakened by design, and given that the current preferred cipher is AES, it might make sense to set <var>SSLCIPH</var> to X'03C0' to force [http://en.wikipedia.org/wiki/Advanced_Encryption_Standard AES] bulk encryption~~. To also to disable the export ciphers, set <var>SSLCIPH</var> to X'03F6'~~.		However, to make only a subset of the server ciphers available, you can specify <var>SSLCIPH</var> followed by the (bitmask) value that selects the subset. For example, <code>SSLCIPH 2</code> indicates that only strong RC4 encryption is available. It is probably a good idea to disable export ciphers (<var>SSLCIPH</var>=X'03F6') as they are weakened by design, and given that the current preferred cipher is AES, it might make sense to set <var>SSLCIPH</var> to X'03C0' to force [http://en.wikipedia.org/wiki/Advanced_Encryption_Standard AES] bulk encryption.

Alex: /* Description */

2014-03-17T20:16:12Z

Description

← Older revision		Revision as of 20:16, 17 March 2014
Line 28:		Line 28:
	<tr><th>X'0008'</th><td>TLS_RSA_EXPORT_WITH_DES40_CBC_SHA</td><td>DES bulk cipher with SHA digest algorithm with 40 bits of the 56 bit DES key transmitted encrypted, the rest transmitted "in the clear" (unencrypted). This is considered a weak level of encryption because of the small number of bits in the unencrypted part of the key. Only available in <var class="product">Model 204</var> 7.5 and later.</td></tr>		<tr><th>X'0008'</th><td>TLS_RSA_EXPORT_WITH_DES40_CBC_SHA</td><td>DES bulk cipher with SHA digest algorithm with 40 bits of the 56 bit DES key transmitted encrypted, the rest transmitted "in the clear" (unencrypted). This is considered a weak level of encryption because of the small number of bits in the unencrypted part of the key. Only available in <var class="product">Model 204</var> 7.5 and later.</td></tr>

	<tr><th>X'0010'</th><td>TLS_RSA_WITH_DES_CBC_SHA</td><td>DES bulk cipher with SHA digest algorithm with all 56 bits of the DES key transmitted encrypted. This is considered a weak level of encryption because of the small number of bits in the key. Only available in <var class="product">Model 204</var> 7.5 and later.~~</td></tr>~~</td></tr>		<tr><th>X'0010'</th><td>TLS_RSA_WITH_DES_CBC_SHA</td><td>DES bulk cipher with SHA digest algorithm with all 56 bits of the DES key transmitted encrypted. This is considered a weak level of encryption because of the small number of bits in the key. Only available in <var class="product">Model 204</var> 7.5 and later.</td></tr>

	<tr><th>X'0020'</th><td>TLS_RSA_WITH_3DES_EDE_CBC_SHA</td><td>Triple-DES bulk cipher with SHA digest algorithm with an encrypted 168 bit key. This is considered a fairly strong level of encryption. Only available in <var class="product">Model 204</var> 7.5 and later.</td></tr>		<tr><th>X'0020'</th><td>TLS_RSA_WITH_3DES_EDE_CBC_SHA</td><td>Triple-DES bulk cipher with SHA digest algorithm with an encrypted 168 bit key. This is considered a fairly strong level of encryption. Only available in <var class="product">Model 204</var> 7.5 and later.</td></tr>

Alex: /* Description */

2014-03-17T20:14:26Z

Description

← Older revision		Revision as of 20:14, 17 March 2014
Line 28:		Line 28:
	<tr><th>X'0008'</th><td>TLS_RSA_EXPORT_WITH_DES40_CBC_SHA</td><td>DES bulk cipher with SHA digest algorithm with 40 bits of the 56 bit DES key transmitted encrypted, the rest transmitted "in the clear" (unencrypted). This is considered a weak level of encryption because of the small number of bits in the unencrypted part of the key. Only available in <var class="product">Model 204</var> 7.5 and later.</td></tr>		<tr><th>X'0008'</th><td>TLS_RSA_EXPORT_WITH_DES40_CBC_SHA</td><td>DES bulk cipher with SHA digest algorithm with 40 bits of the 56 bit DES key transmitted encrypted, the rest transmitted "in the clear" (unencrypted). This is considered a weak level of encryption because of the small number of bits in the unencrypted part of the key. Only available in <var class="product">Model 204</var> 7.5 and later.</td></tr>

	<tr><th>X'0010'</th><td>TLS_RSA_WITH_DES_CBC_SHA</td><td>DES bulk cipher with SHA digest algorithm with all 56 bits of the DES key transmitted encrypted. This is considered a weak level of encryption because of the small number of bits in the key.</td></tr>		<tr><th>X'0010'</th><td>TLS_RSA_WITH_DES_CBC_SHA</td><td>DES bulk cipher with SHA digest algorithm with all 56 bits of the DES key transmitted encrypted. This is considered a weak level of encryption because of the small number of bits in the key. Only available in <var class="product">Model 204</var> 7.5 and later.</td></tr></td></tr>

	<tr><th>X'0020'</th><td>TLS_RSA_WITH_3DES_EDE_CBC_SHA</td><td>Triple-DES bulk cipher with SHA digest algorithm with an encrypted 168 bit key. This is considered a fairly strong level of encryption. Only available in <var class="product">Model 204</var> 7.5 and later.</td></tr>		<tr><th>X'0020'</th><td>TLS_RSA_WITH_3DES_EDE_CBC_SHA</td><td>Triple-DES bulk cipher with SHA digest algorithm with an encrypted 168 bit key. This is considered a fairly strong level of encryption. Only available in <var class="product">Model 204</var> 7.5 and later.</td></tr>
Line 41:		Line 41:
	</table>		</table>

	<var>SSLCIPH</var> is valid for <var>[[JANUS DEFINE#type\|SRVSOCK]]</var>, <var>[[JANUS DEFINE#type\|WEBSERV]]</var>, <var>[[JANUS DEFINE#type\|OPENSERV]]</var>, and <var>[[JANUS DEFINE#type\|SDS]]</var> port types.		<var>SSLCIPH</var> is valid for <var>[[JANUS DEFINE#type\|SRVSOCK]]</var>, <var>[[JANUS DEFINE#type\|CLSOCK]]</var>, <var>[[JANUS DEFINE#type\|WEBSERV]]</var>, <var>[[JANUS DEFINE#type\|OPENSERV]]</var>, and <var>[[JANUS DEFINE#type\|SDS]]</var> port types.

	==See also==		==See also==

Alex at 01:28, 4 March 2014

2014-03-04T01:28:35Z

← Older revision		Revision as of 01:28, 4 March 2014
Line 26:		Line 26:
	<td>RC4 bulk cipher with the SHA digest algorithm with all 128 bits of the RC4 key transmitted encrypted. This is considered a fairly strong encryption algorithm and is preferable to TLS_RSA_WITH_RC4_128_MD5 because SHA is considered a superior digest algorithm.</td></tr>		<td>RC4 bulk cipher with the SHA digest algorithm with all 128 bits of the RC4 key transmitted encrypted. This is considered a fairly strong encryption algorithm and is preferable to TLS_RSA_WITH_RC4_128_MD5 because SHA is considered a superior digest algorithm.</td></tr>

	<tr><th>X'0008'</th><td>TLS_RSA_EXPORT_WITH_DES40_CBC_SHA</td><td>DES bulk cipher with SHA digest algorithm with 40 bits of the 56 bit DES key transmitted encrypted, the rest transmitted "in the clear" (unencrypted). This is considered a weak level of encryption because of the small number of bits in the unencrypted part of the key. Only available in <var class="~~prod~~">Model 204</var> 7.5 and later.</td></tr>		<tr><th>X'0008'</th><td>TLS_RSA_EXPORT_WITH_DES40_CBC_SHA</td><td>DES bulk cipher with SHA digest algorithm with 40 bits of the 56 bit DES key transmitted encrypted, the rest transmitted "in the clear" (unencrypted). This is considered a weak level of encryption because of the small number of bits in the unencrypted part of the key. Only available in <var class="product">Model 204</var> 7.5 and later.</td></tr>

	<tr><th>X'0010'</th><td>TLS_RSA_WITH_DES_CBC_SHA</td><td>DES bulk cipher with SHA digest algorithm with all 56 bits of the DES key transmitted encrypted. This is considered a weak level of encryption because of the small number of bits in the key.</td></tr>		<tr><th>X'0010'</th><td>TLS_RSA_WITH_DES_CBC_SHA</td><td>DES bulk cipher with SHA digest algorithm with all 56 bits of the DES key transmitted encrypted. This is considered a weak level of encryption because of the small number of bits in the key.</td></tr>

	<tr><th>X'0020'</th><td>TLS_RSA_WITH_3DES_EDE_CBC_SHA</td><td>Triple-DES bulk cipher with SHA digest algorithm with an encrypted 168 bit key. This is considered a fairly strong level of encryption. Only available in <var class="~~prod~~">Model 204</var> 7.5 and later.</td></tr>		<tr><th>X'0020'</th><td>TLS_RSA_WITH_3DES_EDE_CBC_SHA</td><td>Triple-DES bulk cipher with SHA digest algorithm with an encrypted 168 bit key. This is considered a fairly strong level of encryption. Only available in <var class="product">Model 204</var> 7.5 and later.</td></tr>

	<tr><th>X'0040'</th><td>TLS_RSA_WITH_AES_128_CBC_SHA</td><td>AES bulk cipher with SHA digest algorithm with an encrypted 128 bit key and encrypting 128 bit blocks. This is considered a strong level of encryption. Only available in <var class="~~prod~~">Model 204</var> 7.5 and later.</td></tr>		<tr><th>X'0040'</th><td>TLS_RSA_WITH_AES_128_CBC_SHA</td><td>AES bulk cipher with SHA digest algorithm with an encrypted 128 bit key and encrypting 128 bit blocks. This is considered a strong level of encryption. Only available in <var class="product">Model 204</var> 7.5 and later.</td></tr>

	<tr><th>X'0080'</th><td>TLS_RSA_WITH_AES_256_CBC_SHA</td><td>AES bulk cipher with SHA digest algorithm with an encrypted 256 bit key and encrypting 256 bit blocks. This is considered a strong level of encryption. Only available in <var class="~~prod~~">Model 204</var> 7.5 and later.</td></tr>		<tr><th>X'0080'</th><td>TLS_RSA_WITH_AES_256_CBC_SHA</td><td>AES bulk cipher with SHA digest algorithm with an encrypted 256 bit key and encrypting 256 bit blocks. This is considered a strong level of encryption. Only available in <var class="product">Model 204</var> 7.5 and later.</td></tr>

	<tr><th>X'0100'</th><td>TLS_RSA_WITH_AES_128_CBC_SHA256</td><td>AES bulk cipher with SHA-256 digest algorithm with an encrypted 128 bit key and encrypting 128 bit blocks. This is considered a strong level of encryption. Only available in <var class="~~prod~~">Model 204</var> 7.5 and later.</td></tr>		<tr><th>X'0100'</th><td>TLS_RSA_WITH_AES_128_CBC_SHA256</td><td>AES bulk cipher with SHA-256 digest algorithm with an encrypted 128 bit key and encrypting 128 bit blocks. This is considered a strong level of encryption. Only available in <var class="product">Model 204</var> 7.5 and later.</td></tr>

	<tr><th>X'0200'</th><td>TLS_RSA_WITH_AES_256_CBC_SHA256</td><td>AES bulk cipher with SHA-256 digest algorithm with an encrypted 256 bit key and encrypting 256 bit blocks. This is considered a strong level of encryption. Only available in <var class="~~prod~~">Model 204</var> 7.5 and later.</td></tr>		<tr><th>X'0200'</th><td>TLS_RSA_WITH_AES_256_CBC_SHA256</td><td>AES bulk cipher with SHA-256 digest algorithm with an encrypted 256 bit key and encrypting 256 bit blocks. This is considered a strong level of encryption. Only available in <var class="product">Model 204</var> 7.5 and later.</td></tr>
	</table>		</table>

JAL at 14:34, 28 February 2014

2014-02-28T14:34:40Z

← Older revision		Revision as of 14:34, 28 February 2014
Line 2:		Line 2:
	<span class="pageSubtitle">SSLCIPH xxx — Limit SSL ciphers offered by this port</span>		<span class="pageSubtitle">SSLCIPH xxx — Limit SSL ciphers offered by this port</span>

			==Description==
	<var>SSLCIPH</var> is a parameter on the <var>[[JANUS DEFINE]]</var> command, which defines and sets characteristics of a Janus port.		<var>SSLCIPH</var> is a parameter on the <var>[[JANUS DEFINE]]</var> command, which defines and sets characteristics of a Janus port.

JAL at 01:41, 28 February 2014

2014-02-28T01:41:24Z

← Older revision		Revision as of 01:41, 28 February 2014
Line 8:		Line 8:
	Typically, <var>SSLCIPH</var> is allowed to default to 0: all the Janus-supported ciphers are available, and the cipher that is ultimately used depends on the outcome of the handshake negotiation with the client that seeks the service at this port. The negotiation selects the strongest available cipher that the client can support.		Typically, <var>SSLCIPH</var> is allowed to default to 0: all the Janus-supported ciphers are available, and the cipher that is ultimately used depends on the outcome of the handshake negotiation with the client that seeks the service at this port. The negotiation selects the strongest available cipher that the client can support.

	However, to make only a subset of the server ciphers available, you can specify <var>SSLCIPH</var> followed by the (bitmask) value that selects the subset. For example, <code>SSLCIPH 2</code> indicates that only strong RC4 encryption is available. It is probably a good idea to disable export ciphers as they are weakened by design, and given that the current preferred cipher is AES, it might make sense to set SSLCIPH to X'03C0' to force [http://en.wikipedia.org/wiki/Advanced_Encryption_Standard AES] bulk encryption.		However, to make only a subset of the server ciphers available, you can specify <var>SSLCIPH</var> followed by the (bitmask) value that selects the subset. For example, <code>SSLCIPH 2</code> indicates that only strong RC4 encryption is available. It is probably a good idea to disable export ciphers as they are weakened by design, and given that the current preferred cipher is AES, it might make sense to set <var>SSLCIPH</var> to X'03C0' to force [http://en.wikipedia.org/wiki/Advanced_Encryption_Standard AES] bulk encryption. To also to disable the export ciphers, set <var>SSLCIPH</var> to X'03F6'.


	Currently, these ciphers are supported:		Currently, these ciphers are supported: