duraconf - A collection of hardened configuration files for SSL/TLS services

Hopefully this will help you make a more informed choice about what cipher list
should be used for different applications. What you find here are recommended
configurations, you should seriously consider using these, but you have to make
some choices. When you pick a cipher list, you have a couple different options
of how you go about it:

1. make a very specific declaration of what is acceptable. This has the
   advantage of being able to define very closely of what you want, but the
   disadvantage of having to stay on top of the latest crypto advancements, with
   every crypto library upgrade.

2. make a general declaration of which cipher list to use. this has the
   advantage of allowing you to rely on your crypto libraries to make
   (hopefully) informed choices for you (and to deactivate known
   bad/weak/recently broken) ciphers while you don't have the burden of ensuring
   that they are always resulting in a good cipher suite. The disadvantage is
   that you cannot fine tune what exactly you get in return.

3. A mixture of being specific and letting your crypto library decide from
   general statements. This can be useful if, for example, you find out that
   some particular crypto has become too weak, for example you might use a
   generic list but then exclude MD5, because your crypto libraries haven't
   removed that yet.

4. Decide on a threat model for possible attacks that may expose an important
   private key. Ciphers are often offered in a mode that provides Perfect
   Forward Secrecy. While there are performance considerations, if you run a
   high security operation where traffic disclosure would be a serious problem,
   it is an important property to consider.

Generally it seems safer to have the crypto library take the bulk of the
decision since it should be for the most part fire-and-forget, while the other
options require that you always stay up to date on things and tweak as needed.

For practical use, and for people who can afford to follow crypto news, a
mixture of both is surely a good idea. So start with the general cipher list and
when you become aware that something is bad then just add this specific part to
your otherwise general cipher list until the crypto library defaults get updated
to fix that.

Unfortunately, its not possible to come up with one cipher configuration that is
going to work for all configurations. There are many different programs that
implement different versions of libraries that have different ciphers
available. In fact, a different versions of the same program may be linked
against different libraries which have different ciphers available.

An important configuration issue for service operators and users is
understanding Perfect Forward Secrecy. Generally, PFS sessions are
computationally more expensive than connections without PFS properties.

It is extremely important to remember that using SSL and/or TLS does not ensure
that your traffic is encrypted for all time. Generally, SSL/TLS services offer
two general modes of operation - one mode is ephemerally keyed and the other is not.

A TLS server that only offers AES256-SHA is strong against an attacker who will
never recovery the secret key used by the server and who cannot break AES256.
However, if an attacker is able to recover the server's key, the attacker will be able
to retroactively decrypt all traffic that has been recorded when the AES256-SHA
cipher is in use. If that same server uses an ephemeral cipher such as
DHE-RSA-AES256-SHA, the attacker cannot recover previous encrypted sesssions
without breaking RSA and/or AES256 for *each* session.

In both cases, when the attacker has the private key, all future communications
with the server are unsafe. Clients generally deal with this by looking up a
revokation list or by using something like the OCSP. Realistically, they're in
a lot of trouble and that kind of trouble is out of scope. If you're in doubt
it's probably a reasonable thing to use DHE or EDH modes unless you have load
issues.

The cipher lists you will find here actually vary depending on which version of
the crypto library that you have. For example, if you were to find this list
recommended:

HIGH:MEDIUM:!aNULL:!SSLv2:!MD5:@STRENGTH

In one version of openssl this will mean the following list of ciphers:

$ openssl ciphers -v 'HIGH:MEDIUM:!aNULL:!SSLv2:!MD5:@STRENGTH'

DHE-RSA-AES256-SHA      SSLv3 Kx=DH       Au=RSA  Enc=AES(256)  Mac=SHA1
DHE-DSS-AES256-SHA      SSLv3 Kx=DH       Au=DSS  Enc=AES(256)  Mac=SHA1
AES256-SHA              SSLv3 Kx=RSA      Au=RSA  Enc=AES(256)  Mac=SHA1
EDH-RSA-DES-CBC3-SHA    SSLv3 Kx=DH       Au=RSA  Enc=3DES(168) Mac=SHA1
EDH-DSS-DES-CBC3-SHA    SSLv3 Kx=DH       Au=DSS  Enc=3DES(168) Mac=SHA1
DES-CBC3-SHA            SSLv3 Kx=RSA      Au=RSA  Enc=3DES(168) Mac=SHA1
DHE-RSA-AES128-SHA      SSLv3 Kx=DH       Au=RSA  Enc=AES(128)  Mac=SHA1
DHE-DSS-AES128-SHA      SSLv3 Kx=DH       Au=DSS  Enc=AES(128)  Mac=SHA1
AES128-SHA              SSLv3 Kx=RSA      Au=RSA  Enc=AES(128)  Mac=SHA1
RC4-SHA                 SSLv3 Kx=RSA      Au=RSA  Enc=RC4(128)  Mac=SHA1

In a newer openssl, this list of ciphers will be different:

$ openssl ciphers -v 'HIGH:MEDIUM:!aNULL:!SSLv2:!MD5:@STRENGTH'

ECDH-RSA-AES128-SHA     SSLv3 Kx=ECDH/RSA   Au=ECDH   Enc=AES(128)      Mac=SHA1
ECDH-ECDSA-AES128-SHA   SSLv3 Kx=ECDH/ECDSA Au=ECDH   Enc=AES(128)      Mac=SHA1
AES128-SHA              SSLv3 Kx=RSA        Au=RSA    Enc=AES(128)      Mac=SHA1
CAMELLIA128-SHA         SSLv3 Kx=RSA        Au=RSA    Enc=Camellia(128) Mac=SHA1
PSK-AES128-CBC-SHA      SSLv3 Kx=PSK        Au=PSK    Enc=AES(128)      Mac=SHA1


It is also worth noting that this is setting a policy, and your site may have
different policies, depending on your intended audience. There are many
questions to consider in determining a policy. For example, in the worst case,
when a client doesn't support the higher strength ciphers my server supports, do
I want to keep up the image that medium strength ciphers are secure enough in my
specific use case, environment and opponents? Or should I not allow anything but
the highest strength ciphers, and those clients that do not support them are
just denied?  Its likely that in many cases there is no possibility of making it
clear to the user that their setup does not allow for secure use of your
services, and what their options are.  I _think_, at least with apache, it
should be possible to redirect users whose setup doesn't provide a compatible
cipher suite, to an informational web page which explains further steps they can
and should take (i have no idea how)..

Unfortunately, in most cases, users will not get any message at all and they
will have no clue why they are shut out. This could result in unhappy users with
no idea of where to turn, and potentially a higher support burden.

Notes on format of cipher designations
--------------------------------------

Format of cipher designations differ, but in general they follow the format
described in ciphers(5). A few notes:

The order specified is the preference order, and the list is separated by
colons. The list can be specific ciphers (eg. RC4-SHA), a list of suites
containing a certain algorith (SHA1), or a cipher suite of a certain type
(TLSv1). There are also cipher strings which are a grouping of different ciphers
into a specific category (eg. HIGH).

When removing ciphers that you do not want, you have a choice between indicating
! or -, the difference is subtle but important. It's good practice to use ! if
you really do not want this class to ever get used, and to use - when you want
to allow them to be still used if you later added something to your existing
cipher list.

Finally, there is also the @STRENGTH parameter, which sorts the cipher list in
order of encryption algorithm key length.

Suggested reading
-----------------

https://www.eff.org/pages/how-deploy-https-correctly