SSL和windows及浏览器等兼容性报告_客户端和服务器不支持一般SSL协议版本或加密套件

需积分: 37 132 浏览量更新于2023-05-21 评论收藏 566KB PDF 举报

身份认证购VIP最低享 7 折!

领优惠券(最高得80元）

资源详情

资源评论

资源推荐

TLS/SSL hardening and

compatibility Report 2011

Author: Thierry ZOLLER

contact@g-sec.lu

http://www.g-sec.lu

SEC™ is a non

commercial and independent group of

Information Security Specialists based in Luxembourg.

Update to the 2010

Report

TLS/SSL Harden

ing & Compatibility Report

2011

Table of Contents

Introduction ................................................................................................................................ 5

Revisions ..................................................................................................................................... 6

Introduction to SSL/TLS ............................................................................................................... 7

SSL/TLS Protocol versions ..................................................................................................................... 7

SSLv2 .............................................................................................................................................................. 7

Differences between SSLv3 and SSLv2............................................................................................................. 8

Differences between TLS v1and SSLv3 ............................................................................................................ 8

Differences between TLS v1.1 and TLS v1 ....................................................................................................... 8

Differences between TLSv1.2 and TLSv1.1 ...................................................................................................... 8

Protocol Key exchange ......................................................................................................................... 9

RSA ................................................................................................................................................................ 9

DH .................................................................................................................................................................. 9

DHE ................................................................................................................................................................ 9

ADH ............................................................................................................................................................... 9

ECDHE ............................................................................................................................................................ 9

Authentication ................................................................................................................................... 10

No authentication ........................................................................................................................................ 10

RSA .............................................................................................................................................................. 10

DSS............................................................................................................................................................... 10

ECDSA .......................................................................................................................................................... 10

KRB5 ............................................................................................................................................................ 10

PSK ............................................................................................................................................................... 10

Encryption ......................................................................................................................................... 11

NULL ............................................................................................................................................................ 11

AES............................................................................................................................................................... 11

CAMELLIA ..................................................................................................................................................... 11

RC4 / RC2 ..................................................................................................................................................... 11

IDEA ............................................................................................................................................................. 11

3DES............................................................................................................................................................. 11

DES .............................................................................................................................................................. 11

Minimum industry Encryption and Key length recommendations ....................................................... 12

Recommended Asymmetric key length ......................................................................................................... 12

Recommended Symmetric key length ........................................................................................................... 12

Recommended Hashing algorithm and size ................................................................................................... 12

Client-side and Server-side Compatibility Overview ................................................................... 13

Client-side: TLS / SSL Compatibility overview ...................................................................................... 14

Default Protocol support .............................................................................................................................. 14

Default Key exchange support ...................................................................................................................... 14

RSA support ................................................................................................................................................. 15

TLS/SSL Harden

ing & Compatibility Report

2011

Default ECC support ..................................................................................................................................... 16

Server-Side: TLS / SSL Compatibility overview .................................................................................... 17

Default protocol support .............................................................................................................................. 17

Default key exchange support....................................................................................................................... 17

Default RSA size support ............................................................................................................................... 18

Recommend Server-Side SSL configuration - Putting it all together - ......................................... 19

IIS7.5 .................................................................................................................................................. 19

IIS7..................................................................................................................................................... 20

IIS6 ................................................................................................................................................... 20

Apache https / Tomcat (OpenSSL 1.0) ................................................................................................ 21

Server configurations – undocumented behaviour .................................................................... 22

General Note ..................................................................................................................................... 22

IIS 7.5 / Windows 7 / Windows 2008R2 .............................................................................................. 22

IIS 6 / Windows 2003 ......................................................................................................................... 23

Apache httpd / Tomcat (OpenSSL) ..................................................................................................... 23

General Recommendations ....................................................................................................... 24

Minimum SSL configuration ............................................................................................................... 24

Recommended SSL configuration ....................................................................................................... 24

Sources ...................................................................................................................................... 24

Thanks ....................................................................................................................................... 25

Disclaimer.................................................................................................................................. 25

Copyright ................................................................................................................................... 25

Appendix ................................................................................................................................... 26

Example code - Listing ciphers (Windows7 & Windows 2008R2) ........................................................ 26

Example Code - Setting preferred cipher (Windows7 & Windows 2008R2) ......................................... 27

Code - Remove ciphers ...................................................................................................................... 27

Default Windows SCHANNEL cipher support ...................................................................................... 28

Windows 7 and Windows Server 2008R2 ...................................................................................................... 28

Windows Vista AND Windows Server 2008 R1 .............................................................................................. 29

Windows XP,2000,2003 ................................................................................................................................ 29

Default Browser support .................................................................................................................... 30

IE6, 7, 8 – Windows XP, 2003, 2000 .............................................................................................................. 30

IE7, IE 8 – Windows Vista .............................................................................................................................. 30

TLS/SSL Harden

ing & Compatibility Report

2011

Introduction

This report gives general recommendations as to how to configure SSL/TLS in order to provide

state of the art authentication and encryption. The options offered by SSL engines grew from

the early days since Netscape developed SSL2.0. The introduction of TLS made matters more

challenging as servers and clients offer different sets of available options depending on which

SSL engine (OpenSSL, NSS, SCHANNEL etc...) they use. Finding the middle ground has proven

difficult especially as the supported protocols and cipher suites are mostly not documented.

To make matters more complicated Browsers may not use all functionality offered by the SSL

stack, this report will only list functionality used by current Browsers.

This report provides an overview of the currently available TLS options across Servers and

Clients and allows you to offer support for a wide variety of Browsers an offer “good enough”

security.

The 2011 version was updated as follows:

 Google Chrome moved away from Microsoft SCHANNEL and now uses Network Security

Services (NSS) offering high end cryptography on legacy windows systems (XP,2000).

 Added Opera Cipher and Protocol Support

 Style Errors

During the creation of this Document two Tools have been developed:

 SSL Harden (beta) – Allows users of Windows 2000, XP, Vista, 7 and particularly

administrators of Windows Server 2003 & 2008R2 to harden SSL/TLS support.

Administrators can manually edit and backup the SSL configuration and set PCI-DSS

compliant SSL rules with a click of a button. Link

 SSL Audit (alpha) - A remote SSL audit tool able scan for SSL/TLS support against remote

servers. SSL Audit uses its own small parsing engine and does not rely on OpenSSL or

other SSL engines allowing it to detect ciphers not supported by OpenSSL. Link

Please note that this summary does not take into account the arrival of quantum computing.

Large quantum computers able to crack large RSA keys are foreseen for 2014 by the ARDA and

2018 by Prof Lloyd

. Shor’s algorithm could then be used to break the RSA key sizes very fast.

We recommend to push for ECC based certificates as soon as possible.

The information is believed to be correct at the time of writing, due to the nature of

undocumented features there might be slight errors in this version if you believe the

http://synaptic-labs.com/ecosystem/context-qc-relevant-today.html

剩余30页未读，继续阅读

myf526cn

粉丝: 0
资源: 11

会员权益专享

SSL 和windows及浏览器等兼容性报告

评论0

会员权益专享

最新资源

SSL 和windows及浏览器等兼容性报告

评论0

客户端与服务器SSL双向认证(客户端：java-服务端：java)

SSL TLS安全评估报告 | 谷歌（Chrome）浏览器插件

Opera7.23-SSLv3 https可以使用的浏览器

那怎么对音视频数据进行加密传输和存储以及浏览器的兼容性和性能问题如何考虑

导入ssl证书后Google浏览器访问提示证书无效

microsoft windows ce 5.0 浏览器

浏览器配置ssl双向认证

为什么浏览器的版本升高了回出现ERR_SSL_KEY_USAGE_INCOMPATIBLE

google浏览器ssl证书下载

edge浏览器ssl协议

ssl证书和tls有什么区别

google浏览器安装ssl证书

windows ssl

为什么所有浏览器网页都打不开显示RR_SSL_KEY_USAGE_INCOMPATIBLE

ssl/tls的优缺点

http和https绑定本机与外部通信的IP地址，仅允许使用域名访问（使用“计算机副本”证书模板）。客户端访问时，必需有ssl证书（浏览器证书模板为“管理员”）。

浏览器报ERR_SSL_VERSION_OR_CIPHER_MISMATCH 怎么处理

如何检查是否安装ssl证书

此站点的连接不安全openai.com 使用不受支持的协议。 ERR_SSL_VERSION_OR_CIPHER_MISMATCH

详细介绍SSLvpn安全网关和国密浏览器

会员权益专享

最新资源