1 \section{Recommendations on practical settings}
6 %%% NOTE: we do not need to list this all here, can move to an appendix
7 %At the time of this writing, SSL is defined in RFCs:
10 %\item RFC2246 - TLS1.0
12 %\item RFC4132 - Camelia
15 %\item RFC4346 - TLS 1.1
17 %\item RFC4785 - PSK\_NULL
18 %\item RFC5246 - TLS 1.2
19 %\item RFC5288 - AES\_GCM
20 %\item RFC5289 - AES\_GCM\_SHA2\_ECC
21 %\item RFC5430 - Suite B
22 %\item RFC5487 - GCM\_PSK
23 %\item RFC5489 - ECDHE\_PSK
24 %\item RFC5932 - Camelia
25 %\item RFC6101 - SSL 3.0
27 %\item RFC6367 - Camelia
28 %\item RFC6655 - AES\_CCM
29 %\item RFC7027 - Brainpool Curves
32 \subsubsection{Overview of SSL Server settings}
34 Most Server software (Webservers, Mail servers, etc.) can be configured to prefer certain cipher suites over others.
35 We followed the recommendations by Ivan Ristic's SSL/TLS Deployment Best Practices\footnote{\url{https://www.ssllabs.com/projects/best-practices/index.html}} document (see section 2.2 "Use Secure Protocols") and arrived at a list of recommended cipher suites for SSL enabled servers.
37 Following Ivan Ristic's adivce we arrived at a categorisation of cipher suites.
40 \begin{tabular}{| l | l | l | l | l|}
42 & Version & Key\_Exchange & Cipher & MAC \\ \hline
43 \cellcolor{green}prefer & TLS 1.2 & DHE\_DSS & AES\_256\_GCM & SHA384 \\ \hline
44 & & DHE\_RSA & AES\_256\_CCM & SHA256 \\ \hline
45 & & ECDHE\_ECDSA & AES\_256\_CBC & \\ \hline
46 & & ECDHE\_RSA & & \\ \hline
48 \cellcolor{orange}consider & TLS 1.1 & DH\_DSS & AES\_128\_GCM & SHA \\ \hline
49 & TLS 1.0 & DH\_RSA & AES\_128\_CCM & \\ \hline
50 & & ECDH\_ECDSA & AES\_128\_CBC & \\ \hline
51 & & ECDH\_RSA & CAMELLIA\_256\_CBC & \\ \hline
52 & & RSA & CAMELLIA\_128\_CBC & \\ \hline
55 & SSL 3.0 & NULL & NULL & NULL \\ \hline
56 & & DH\_anon & RC4\_128 & MD5 \\ \hline
57 & & ECDH\_anon & 3DES\_EDE\_CBC & \\ \hline
58 & & & DES\_CBC & \\ \hline
60 \cellcolor{blue}{\color{white}special }
61 & & PSK & CAMELLIA\_256\_GCM & \\ \hline
62 & & DHE\_PSK & CAMELLIA\_128\_GCM & \\ \hline
63 & & RSA\_PSK & ARIA\_256\_GCM & \\ \hline
64 & & ECDHE\_PSK & ARIA\_256\_CBC & \\ \hline
65 & & & ARIA\_128\_GCM & \\ \hline
66 & & & ARIA\_128\_CBC & \\ \hline
67 & & & SEED & \\ \hline
71 A remark on the ``consider'' section: the BSI (Federal office for information security, Germany) recommends in its technical report TR-02102-2\footnote{\url{https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/TechnischeRichtlinien/TR02102/BSI-TR-02102-2_pdf.html}} to \textbf{avoid} non-ephemeral\footnote{ephemeral keys are session keys which are destroyed upon termination of the encrypted session. In TLS/SSL, they are realized by the DHE cipher suites. } keys for any communication which might contain personal or sensitive data. In this document, we follow BSI's advice and therefore only keep cipher suites containing (EC)DH\textbf{E} (ephemeral) variants. System administrators, who can not use forward secrecy can still use the cipher suites in the ``consider'' section. We however, do not recommend them in this document.
73 %% NOTE: s/forward secrecy/perfect forward secrecy???
75 Note that the entries marked as ``special'' are cipher suites which are not common to all clients (webbrowsers etc).
78 \subsubsection{Tested clients}
80 Next we tested the cipher suites above on the following clients:
82 %% NOTE: we need to test with more systems!!
84 \item Chrome 30.0.1599.101 Mac OS X 10.9
85 \item Safari 7.0 Mac OS X 10.9
86 \item Firefox 25.0 Mac OS X 10.9
87 \item Internet Explorer 10 Windows 7
92 The result of testing the cipher suites with these clients gives us a preference order as shown in table \ref{table:prefOrderCipherSuites}.
93 Should a client not be able to use a specific cipher suite, it will fall back to the next possible entry as given by the ordering.
98 \begin{tabular}{|l|l|l|l|l|}
100 Pref & Cipher Suite & ID & Browser \\ \hline
101 1 & TLS\_DHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384 & 0x009f & OpenSSL command line client \\ \hline
102 2 & TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA384 & 0xC024 & Safari \\ \hline
103 3 & TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA384 & 0xC028 & Safari \\ \hline
104 4 & TLS\_DHE\_RSA\_WITH\_AES\_256\_CBC\_SHA256 & 0x006B & Safari, Chrome \\ \hline
105 5 & TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA & 0xC00A & Safari, Chrome, Firefox, IE \\ \hline
106 6 & TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA & 0xC014 & Safari, Chrome, Firefox, IE \\ \hline
107 7 & TLS\_DHE\_RSA\_WITH\_AES\_256\_CBC\_SHA & 0x0039 & Safari, Chrome, Firefox \\ \hline
108 8 & TLS\_DHE\_DSS\_WITH\_AES\_256\_CBC\_SHA & 0x0038 & Firefox, IE \\ \hline
109 9 & TLS\_DHE\_RSA\_WITH\_CAMELLIA\_256\_CBC\_SHA & 0x0088 & Firefox \\ \hline
110 10 & TLS\_DHE\_DSS\_WITH\_CAMELLIA\_256\_CBC\_SHA & 0x0087 & Firefox \\ \hline
112 \caption{Preference order of cipher suites}
113 \label{table:prefOrderCipherSuites}
118 Table \ref{table:prefOrderOpenSSLNames} shows the same data again with specifying the corresponding OpenSSL name.
123 \begin{tabular}{|l|l|l|}
125 Cipher Suite & ID & OpenSSL Name \\ \hline
126 TLS\_DHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384 & 0x009f & DHE-RSA-AES256-GCM-SHA384 \\ \hline
127 TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA384 & 0xC024 & ECDHE-ECDSA-AES256-SHA384 \\ \hline
128 TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA384 & 0xC028 & ECDHE-RSA-AES256-SHA384 \\ \hline
129 TLS\_DHE\_RSA\_WITH\_AES\_256\_CBC\_SHA256 & 0x006B & DHE-RSA-AES256-SHA256 \\ \hline
130 TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA & 0xC00A & ECDHE-ECDSA-AES256-SHA \\ \hline
131 TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA & 0xC014 & ECDHE-RSA-AES256-SHA \\ \hline
132 TLS\_DHE\_RSA\_WITH\_AES\_256\_CBC\_SHA & 0x0039 & DHE-RSA-AES256-SHA \\ \hline
133 TLS\_DHE\_DSS\_WITH\_AES\_256\_CBC\_SHA & 0x0038 & DHE-DSS-AES256-SHA \\ \hline
134 TLS\_DHE\_RSA\_WITH\_CAMELLIA\_256\_CBC\_SHA & 0x0088 & DHE-RSA-CAMELLIA256-SHA \\ \hline
135 TLS\_DHE\_DSS\_WITH\_CAMELLIA\_256\_CBC\_SHA & 0x0087 & DHE-DSS-CAMELLIA256-SHA \\ \hline
137 \caption{Preference order of cipher suites, with OpenSSL names}
138 \label{table:prefOrderOpenSSLNames}
142 Note: the tables \ref{table:prefOrderOpenSSLNames} and \ref{table:prefOrderCipherSuites} contain Elliptic curve key exchanges. There are currently strong doubts\footnote{\url{http://safecurves.cr.yp.to/rigid.html}} concerning ECC.
143 If unsure, remove the cipher suites starting with ECDHE in the table above.
146 Based on this ordering, we can now define the corresponding settings for servers. We will start with the most common web servers
148 \subsubsection{Apache}
150 Note: a "\textbackslash" (backslash) denotes a line continuation which was wrapped due to formatting reasons here. Do not copy it verbatim.
152 %-All +TLSv1.1 +TLSv1.2
154 SSLProtocol All -SSLv2 -SSLv3
155 SSLHonorCipherOrder On
157 # Add six earth month HSTS header for all users...
158 Header add Strict-Transport-Security "max-age=15768000"
159 # If you want to protect all subdomains, use the following header
160 # ALL subdomains HAVE TO support https if you use this!
161 # Strict-Transport-Security: max-age=15768000 ; includeSubDomains
163 SSLCipherSuite DHE+AESGCM:\
164 ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:\
165 DHE-RSA-AES256-SHA256:ECDHE-ECDSA-AES256-SHA:\
166 ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:\
167 DHE-DSS-AES256-SHA:DHE-RSA-CAMELLIA256-SHA:\
168 DHE-DSS-CAMELLIA256-SHA:!ADH:!AECDH:!MD5:!DSS
171 Note again, that any cipher suite starting with ECDHE can be omitted in case of doubt.
172 %% XXX NOTE TO SELF: remove from future automatically generated lists!
174 You should redirect everything to httpS:// if possible. In Apache you can do this with the following setting inside of a VirtualHost environment:
180 RewriteRule ^.*$ https://%{SERVER_NAME}%{REQUEST_URI} [L,R=permanent]
185 %XXXX ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AES:RSA+3DES:!ADH:!AECDH:!MD5:!DSS
188 \subsubsection{lighttpd}
190 %% Note: need to be checked / reviewed
192 %% Complete ssl.cipher-list with same algo than Apache
193 %% Currently this is only the default proposed lighttpd config for SSL
195 $SERVER["socket"] == "0.0.0.0:443" {
196 ssl.engine = "enable"
197 ssl.use-sslv2 = "disable"
198 ssl.use-sslv3 = "disable"
199 ssl.use-compression = "disable"
200 ssl.pemfile = "/etc/lighttpd/server.pem"
201 ssl.cipher-list = "DHE+AESGCM:\
202 ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:\
203 DHE-RSA-AES256-SHA256:ECDHE-ECDSA-AES256-SHA:\
204 ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:\
205 DHE-DSS-AES256-SHA:DHE-RSA-CAMELLIA256-SHA:\
206 DHE-DSS-CAMELLIA256-SHA:!ADH:!AECDH:!MD5:!DSS"
207 ssl.honor-cipher-order = "enable"
211 As for any other webserver, you should redirect automatically http traffic toward httpS:\footnote{That proposed configuration is directly coming from lighttpd documentation: \url{http://redmine.lighttpd.net/projects/1/wiki/HowToRedirectHttpToHttps}}
214 $HTTP["scheme"] == "http" {
215 # capture vhost name with regex conditiona -> %0 in redirect pattern
216 # must be the most inner block to the redirect rule
217 $HTTP["host"] =~ ".*" {
218 url.redirect = (".*" => "https://%0$0")
223 \subsubsection{nginx}
226 ssl_prefer_server_ciphers on;
227 ssl_protocols -SSLv2 -SSLv3;
228 ssl_ciphers DHE+AESGCM:\
229 ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:\
230 DHE-RSA-AES256-SHA256:ECDHE-ECDSA-AES256-SHA:\
231 ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:\
232 DHE-DSS-AES256-SHA:DHE-RSA-CAMELLIA256-SHA:\
233 DHE-DSS-CAMELLIA256-SHA:!ADH:!AECDH:!MD5:!DSS;
234 add_header Strict-Transport-Security max-age=2592000;
235 add_header X-Frame-Options DENY;
238 %% XXX FIXME: do we need to specify dhparams? Parameter: ssl_dhparam = file. See: http://wiki.nginx.org/HttpSslModule#ssl_protocols
241 If you decide to trust NIST's ECC curve recommendation, you can add the following line to nginx's configuration file to select special curves:
244 ssl_ecdh_curve sect571k1;
247 You should redirect everything to httpS:// if possible. In Nginx you can do this with the following setting:
250 rewrite ^(.*) https://$host$1 permanent;
253 %\subsubsection{openssl.conf settings}
255 %\subsubsection{Differences in SSL libraries: gnutls vs. openssl vs. others}
257 \subsubsection{MS IIS}
260 When trying to avoid RC4 and CBC (BEAST-Attack) and requiring perfect
261 forward secrecy, Microsoft Internet Information Server (IIS) supports
262 ECDSA, but does not support RSA for key exchange (consider ECC suite
263 B doubts\footnote{\url{http://safecurves.cr.yp.to/rigid.html}}).
265 Since \verb|ECDHE_RSA_*| is not supported, a SSL certificate based on
266 elliptic curves needs to be used.
268 The configuration of cipher suites MS IIS will use can be configured in one
269 of the following ways:
271 \item Group Policy \footnote{\url{http://msdn.microsoft.com/en-us/library/windows/desktop/bb870930(v=vs.85).aspx}}
273 \item IIS Crypto~\footnote{\url{https://www.nartac.com/Products/IISCrypto/}}
277 Table~\ref{tab:MS_IIS_Client_Support} shows the process of turning on
278 one algorithm after another and the effect on the supported Clients
279 tested using https://www.ssllabs.com.
281 \verb|SSL 3.0|, \verb|SSL 2.0| and \verb|MD5| are turned off.
282 \verb|TLS 1.0| and \verb|TLS 2.0| are turned on.
287 \begin{tabular}{|l|l|}
289 Cipher Suite & Client \\
291 \verb|TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256| & only IE 10,11, OpenSSL 1.0.1e \\
293 \verb|TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256| & Chrome 30, Opera 17, Safari 6+ \\
295 \verb|TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA| & FF 10-24, IE 8+, Safari 5, Java 7\\
298 \caption{Client support}
299 \label{tab:MS_IIS_Client_Support}
302 Table~\ref{tab:MS_IIS_Client_Support} shows the algoriths from
303 strongest to weakest and why they need to be added in this order. For
304 example insiting on SHA-2 algorithms (only first two lines) would
305 eliminate all versions of Firefox, so the last line is needed to
306 support this browser, but should be placed at the bottom, so capable
307 browsers will choose the stronger SHA-2 algorithms.
309 \verb|TLS_RSA_WITH_RC4_128_SHA| or equivalent should also be added if
310 MS Terminal Server Connection is used (make sure to use this only in a
311 trusted environment). This suite will not be used for SSL, since we do
315 % \verb|TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256| ... only supported by: IE 10,11, OpenSSL 1.0.1e
316 % \verb|TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256| ... Chrome 30, Opera 17, Safari 6+
317 % \verb|TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA| ... Firefox 10-24, IE 8+, Safari 5, Java 7
320 Not supported Clients:
329 \subsubsection{Dovecot}
333 % Example: http://dovecot.org/list/dovecot/2013-October/092999.html
336 ssl_cipher_list = DHE+AESGCM:\
337 ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:\
338 DHE-RSA-AES256-SHA256:ECDHE-ECDSA-AES256-SHA:\
339 ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:\
340 DHE-DSS-AES256-SHA:DHE-RSA-CAMELLIA256-SHA:\
341 DHE-DSS-CAMELLIA256-SHA:!ADH:!AECDH:!MD5:!DSS
342 ssl_prefer_server_ciphers = yes
345 Dovecot 2.1: Almost as good as dovecot 2.2. Does not support ssl\_prefer\_server\_ciphers
348 \subsubsection{Cyrus}
352 Another option to secure IMAPs servers is to place them behind an stunnel server.
354 % XXX config von Adi?
356 % ciphers = EDH+CAMELLIA256:EDH+aRSA:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4:!SEED:-AES128:!CAMELLIA128:!ECDSA:AES256-SHA:EDH+AES128;
357 % options = CIPHER_SERVER_PREFERENCE
360 \subsubsection{Postfix}
362 First, you need to generate Diffie Hellman parameters (please first take a look at the section \ref{section:PRNG}):
365 % openssl gendh -out /etc/postfix/dh_param_512.pem -2 512
366 % openssl gendh -out /etc/postfix/dh_param_1024.pem -2 1024
369 Next, we specify these DH parameters in the postfix config file:
372 smtpd_tls_dh512_param_file = /etc/postfix/dh_param_512.pem
373 smtpd_tls_dh1024_param_file = /etc/postfix/dh_param_1024.pem
376 You usually don't want restrictions on the ciphers for opportunistic
377 encryption, because any encryption is better than plain text.
379 For submission (Port 587) or other special cases, however, you want to
380 enforce strong encryption. In addition to the below entries in
381 main.cf, you need to enable ``mandatory`` encryption for the
382 respective service, e.g. by adding ``-o
383 smtpd\_tls\_security\_level=encrypt'' to the submission smtpd in
386 % don't -- this influences opportunistic encryption
387 % smtpd_tls_protocols = !SSLv2, !SSLv3
390 smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
391 tls_ssl_options=NO_COMPRESSION
392 smtpd_tls_mandatory_ciphers=high
393 tls_high_cipherlist=DHE+AESGCM:ECDHE-ECDSA-AES256-SHA384:\
394 ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256:ECDHE-ECDSA-AES256-SHA:\
395 ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:\
396 DHE-RSA-CAMELLIA256-SHA:DHE-DSS-CAMELLIA256-SHA:!ADH:!AECDH:\
398 tls_preempt_cipherlist = yes
399 tls_random_source = dev:/dev/urandom
400 %% NOTE: might want to have /dev/random here + Haveged
403 For those users, who want to use ECC key exchange, it is possible to specify this via:
405 smtpd_tls_eecdh_grade = ultra
408 You can check the settings by specifying smtpd\_tls\_loglevel = 1 and then check the selected ciphers with the following command:
410 $ zegrep "TLS connection established from.*with cipher" /var/log/mail.log | \
411 > awk '{printf("%s %s %s %s\n", $12, $13, $14, $15)}' | sort | uniq -c | sort -n
412 1 SSLv3 with cipher DHE-RSA-AES256-SHA
413 23 TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384
414 60 TLSv1 with cipher ECDHE-RSA-AES256-SHA
415 270 TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384
416 335 TLSv1 with cipher DHE-RSA-AES256-SHA
419 Source: \url{http://www.postfix.org/TLS_README.html}
421 \subsubsection{SMTP: opportunistic TLS}
422 % do we need to documment starttls in detail?
423 %\subsubsection{starttls?}
428 RSAAuthentication yes
431 HostKey /etc/ssh/ssh_host_rsa_key
433 MACs hmac-sha2-512,hmac-sha2-256,hmac-ripemd160
434 KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1
437 % XXX: curve25519-sha256@libssh.org only available upstream(!)
438 Note: older linux systems won't support SHA2, PuTTY does not support RIPE-MD160.
446 \subsection{PRNG settings}
452 %%% TeX-master: "applied-crypto-hardening"