SSL和windows及浏览器等兼容性报告_客户端和服务器不支持一般SSL协议版本或加密套件资源-CSDN文库

需积分: 37 160 浏览量 2018-11-29 14:41:07 上传评论收藏 566KB PDF 举报

资源推荐

资源详情

资源评论

TLS/SSL hardening and

compatibility Report 2011

Author: Thierry ZOLLER

contact@g-sec.lu

http://www.g-sec.lu

SEC™ is a non

commercial and independent group of

Information Security Specialists based in Luxembourg.

Update to the 2010

Report

TLS/SSL Harden

ing & Compatibility Report

2011

Table of Contents

Introduction ................................................................................................................................ 5

Revisions ..................................................................................................................................... 6

Introduction to SSL/TLS ............................................................................................................... 7

SSL/TLS Protocol versions ..................................................................................................................... 7

SSLv2 .............................................................................................................................................................. 7

Differences between SSLv3 and SSLv2............................................................................................................. 8

Differences between TLS v1and SSLv3 ............................................................................................................ 8

Differences between TLS v1.1 and TLS v1 ....................................................................................................... 8

Differences between TLSv1.2 and TLSv1.1 ...................................................................................................... 8

Protocol Key exchange ......................................................................................................................... 9

RSA ................................................................................................................................................................ 9

DH .................................................................................................................................................................. 9

DHE ................................................................................................................................................................ 9

ADH ............................................................................................................................................................... 9

ECDHE ............................................................................................................................................................ 9

Authentication ................................................................................................................................... 10

No authentication ........................................................................................................................................ 10

RSA .............................................................................................................................................................. 10

DSS............................................................................................................................................................... 10

ECDSA .......................................................................................................................................................... 10

KRB5 ............................................................................................................................................................ 10

PSK ............................................................................................................................................................... 10

Encryption ......................................................................................................................................... 11

NULL ............................................................................................................................................................ 11

AES............................................................................................................................................................... 11

CAMELLIA ..................................................................................................................................................... 11

RC4 / RC2 ..................................................................................................................................................... 11

IDEA ............................................................................................................................................................. 11

3DES............................................................................................................................................................. 11

DES .............................................................................................................................................................. 11

Minimum industry Encryption and Key length recommendations ....................................................... 12

Recommended Asymmetric key length ......................................................................................................... 12

Recommended Symmetric key length ........................................................................................................... 12

Recommended Hashing algorithm and size ................................................................................................... 12

Client-side and Server-side Compatibility Overview ................................................................... 13

Client-side: TLS / SSL Compatibility overview ...................................................................................... 14

Default Protocol support .............................................................................................................................. 14

Default Key exchange support ...................................................................................................................... 14

RSA support ................................................................................................................................................. 15

TLS/SSL Harden

ing & Compatibility Report

2011

Default ECC support ..................................................................................................................................... 16

Server-Side: TLS / SSL Compatibility overview .................................................................................... 17

Default protocol support .............................................................................................................................. 17

Default key exchange support....................................................................................................................... 17

Default RSA size support ............................................................................................................................... 18

Recommend Server-Side SSL configuration - Putting it all together - ......................................... 19

IIS7.5 .................................................................................................................................................. 19

IIS7..................................................................................................................................................... 20

IIS6 ................................................................................................................................................... 20

Apache https / Tomcat (OpenSSL 1.0) ................................................................................................ 21

Server configurations – undocumented behaviour .................................................................... 22

General Note ..................................................................................................................................... 22

IIS 7.5 / Windows 7 / Windows 2008R2 .............................................................................................. 22

IIS 6 / Windows 2003 ......................................................................................................................... 23

Apache httpd / Tomcat (OpenSSL) ..................................................................................................... 23

General Recommendations ....................................................................................................... 24

Minimum SSL configuration ............................................................................................................... 24

Recommended SSL configuration ....................................................................................................... 24

Sources ...................................................................................................................................... 24

Thanks ....................................................................................................................................... 25

Disclaimer.................................................................................................................................. 25

Copyright ................................................................................................................................... 25

Appendix ................................................................................................................................... 26

Example code - Listing ciphers (Windows7 & Windows 2008R2) ........................................................ 26

Example Code - Setting preferred cipher (Windows7 & Windows 2008R2) ......................................... 27

Code - Remove ciphers ...................................................................................................................... 27

Default Windows SCHANNEL cipher support ...................................................................................... 28

Windows 7 and Windows Server 2008R2 ...................................................................................................... 28

Windows Vista AND Windows Server 2008 R1 .............................................................................................. 29

Windows XP,2000,2003 ................................................................................................................................ 29

Default Browser support .................................................................................................................... 30

IE6, 7, 8 – Windows XP, 2003, 2000 .............................................................................................................. 30

IE7, IE 8 – Windows Vista .............................................................................................................................. 30

TLS/SSL Harden

ing & Compatibility Report

2011

Introduction

This report gives general recommendations as to how to configure SSL/TLS in order to provide

state of the art authentication and encryption. The options offered by SSL engines grew from

the early days since Netscape developed SSL2.0. The introduction of TLS made matters more

challenging as servers and clients offer different sets of available options depending on which

SSL engine (OpenSSL, NSS, SCHANNEL etc...) they use. Finding the middle ground has proven

difficult especially as the supported protocols and cipher suites are mostly not documented.

To make matters more complicated Browsers may not use all functionality offered by the SSL

stack, this report will only list functionality used by current Browsers.

This report provides an overview of the currently available TLS options across Servers and

Clients and allows you to offer support for a wide variety of Browsers an offer “good enough”

security.

The 2011 version was updated as follows:

 Google Chrome moved away from Microsoft SCHANNEL and now uses Network Security

Services (NSS) offering high end cryptography on legacy windows systems (XP,2000).

 Added Opera Cipher and Protocol Support

 Style Errors

During the creation of this Document two Tools have been developed:

 SSL Harden (beta) – Allows users of Windows 2000, XP, Vista, 7 and particularly

administrators of Windows Server 2003 & 2008R2 to harden SSL/TLS support.

Administrators can manually edit and backup the SSL configuration and set PCI-DSS

compliant SSL rules with a click of a button. Link

 SSL Audit (alpha) - A remote SSL audit tool able scan for SSL/TLS support against remote

servers. SSL Audit uses its own small parsing engine and does not rely on OpenSSL or

other SSL engines allowing it to detect ciphers not supported by OpenSSL. Link

Please note that this summary does not take into account the arrival of quantum computing.

Large quantum computers able to crack large RSA keys are foreseen for 2014 by the ARDA and

2018 by Prof Lloyd

. Shor’s algorithm could then be used to break the RSA key sizes very fast.

We recommend to push for ECC based certificates as soon as possible.

The information is believed to be correct at the time of writing, due to the nature of

undocumented features there might be slight errors in this version if you believe the

http://synaptic-labs.com/ecosystem/context-qc-relevant-today.html

剩余30页未读，继续阅读

评论收藏

内容反馈

myf526cn

粉丝: 0
资源: 11

SSL 和windows及浏览器等兼容性报告

最新资源

SSL 和windows及浏览器等兼容性报告

SSL TLS安全评估报告 | 谷歌（Chrome）浏览器插件

基于SSL/TLS协议的FTP客户端和服务器端

客户端与服务器SSL双向认证(客户端：java-服务端：java)

Opera7.23-SSLv3 https可以使用的浏览器

Tomcat 配置SSL完美 https可以正常使用 小程序调用

建议大家换个浏览器opera世界最好没有其2

citrix 中文管理操作手册

NTKO OFFICE痕迹保留文档控件.rar

IIS服务器SSI(rewrite重写)插件的帮助资料

SharpTLSScan:扫描服务器以获取受支持的SSL和TLS版本以及密码套件。 同时检查服务器的证书。 支持SSLv2-TLSv1.2

小程序 Windows 2008 r2设置IIS中开启TLS1.2，IISCrypto下载

Tomcat中实现https安全连接与SSL配置

RouterOS2.9.6.with.crack及配置动画

IIS6.0 IIS，互联网信息服务

NTKO文档在线编辑控件4.0.1.2

NTKO文档在线编辑控件独立安装包4.0.6.5(适合TA2009\2010\2011版本)

ServU_v11105

TCP/IP技术大全（中文PDF非扫描版）

TCP-IP技术大全

ASP.NET4高级程序设计第4版 带目录PDF 分卷压缩包 part1

TCP/IP教程TCP/IP基础

TCP/IP技术大全

TCP/IP详解

ASP.NET4高级程序设计(第4版) 3/3

java开源包1

BurpLoaderKeygen.jar.zip

最新版ISO/IEC 27001:2022、ISO 27002:2022中英文合集

最新资源

Tomcat 配置SSL完美 https可以正常使用小程序调用

SharpTLSScan:扫描服务器以获取受支持的SSL和TLS版本以及密码套件。同时检查服务器的证书。支持SSLv2-TLSv1.2

ASP.NET4高级程序设计第4版带目录PDF 分卷压缩包 part1