RFC: Including Mozilla recommended cipher suites in mod_ssl conf file

[Eric Christensen]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

The default settings for mod_ssl (for use in httpd) is:

SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5

This isn't a great default (for many reasons).  I'd like to propose we provide the
default ciphers suites as defined by Mozilla[0] in the configuration file with the
Intermediate compatibility cipher suite uncommented:
<quote>
#This is the modern cipher suite that provides a higher level of security and is
compatible with the latest browsers.
#SSLCipherSuite
ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK

#This is the intermediate cipher suite that provides good security and compatibility with
many browsers.
SSLCipherSuite
ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA

#This is the old, backward compatibility cipher suite that works with clients back to
Windows XP/IE6.  This should only be used as a last resort.
#SSLCipherSuite
ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
</quote>

By providing these recommended ciphers in the config file we provide the admin with a very
good starting point with an easy way to move between configurations or change to something
completely different.

[0] https://wiki.mozilla.org/Security/Server_Side_TLS#Recommended_configurations

- -- Eric

- --------------------------------------------------
Eric "Sparks" Christensen
Fedora Project

sparks(a)fedoraproject.org - sparks(a)redhat.com
097C 82C3 52DF C64A 50C2  E3A3 8076 ABDE 024B B3D1
- --------------------------------------------------
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1
>
> iQGcBAEBCgAGBQJUgIRDAAoJEB/kgVGp2CYvwGML/12tIYqi1wMK3dmcK2HSenh2
> bwsNcIm7jL+jnsg5NLuBZjaJcDduMfFHAn5yh3WdG7lRzozMLy+EGZwDKCvUS2Vk
> okfPHRjD+Br37PceYYF1Pn1scHIK05JNw8TvYX52+unQDfdLRWEdaIoGZSP/oZk3
> y5DhMBFnwediVBtdLYYbN9r4scaCDQOLBjUt4UmiKTiKbDNbEFRZn/VvGhDIX5RK
> niVbUO2g5/V319z3tnPQjd4b1DGRVDtWvpD27pco+ca+6Ywx8hiPD3mr5vr1/P0K
> OCn76gPuc4JaMSWeU80payp+YjJjprIt+AsteGroCzNX1pNn3bXPTY9JyGHXS/7S
> CNxdN6arqfyDJHai0/dTDy1GKPEiF0g1weFhFoF3SxtN9+duiQYP3z7enSbZyfTD
> AkZ0Dk6T0JHHhF2ojQ7Cf2+0ldE2eDu+iGD7xkreGF5nhUExYOgJOcpTnpjceo2w
> DsjymoBjAn4KS/vq1PEZauTsnzpLOhcWTZIRPHpnQg==
> =Aj6M
> -----END PGP SIGNATURE-----

[Miloslav Trmač]

----- Original Message -----
>  The default settings for mod_ssl (for use in httpd) is:
>  
>  SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
>  
>  This isn't a great default (for many reasons).  I'd like to propose we
>  provide the default ciphers suites as defined by Mozilla[0] in the
>  configuration file with the Intermediate compatibility cipher suite
>  uncommented: 
>  <quote>
>  #This is the modern cipher suite that provides a higher level of security and
>  is compatible with the latest browsers.
>  #SSLCipherSuite
>
> ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK
<snip more endless unmaintainable strings>

I think we should try very hard to never end up with such a string inside a modified,
admin-maintained, config file; we won’t be able to reasonably update it if the trade-offs
and recommendations change.

In particular, per https://fedoraproject.org/wiki/Changes/CryptoPolicy and
https://bugzilla.redhat.com/show_bug.cgi?id=1109119  we should already be using a sane
default (though perhaps not precisely the one you are recommending).

Can what you want to do be done using the CryptoPolicy mechanism?  (And should it be the
default?)
   Mirek

[Eric Christensen]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On Thu, Dec 04, 2014 at 11:31:04AM -0500, Miloslav Trmač wrote:
>  ----- Original Message -----
>  > The default settings for mod_ssl (for use in httpd) is:
>  > 
>  > SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
>  > 
>  > This isn't a great default (for many reasons).  I'd like to propose we
>  > provide the default ciphers suites as defined by Mozilla[0] in the
>  > configuration file with the Intermediate compatibility cipher suite
>  > uncommented:
>  
>  > <quote>
>  > #This is the modern cipher suite that provides a higher level of security and
>  > is compatible with the latest browsers.
>  > #SSLCipherSuite
>  >
> ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK
<removing unhelpful and unuseful input>

>  Can what you want to do be done using the CryptoPolicy mechanism? 
> (And should it be the default?) 
Yes, and thank you for reminding me of this new, upcoming feature.

There will always be a default and that default should be something sane that both
provides protection and compatibility.  The current default leaves something to be desired
with respect to security.  Using the recommendations provided by Mozilla you get both in a
balanced way.  I could see the three recommended cipher suites lists being used as a low,
default, and high security ratings within the CryptoPolicy.

- -- Eric

- --------------------------------------------------
Eric "Sparks" Christensen
Red Hat, Inc - Product Security

sparks(a)redhat.com - sparks(a)fedoraproject.org
097C 82C3 52DF C64A 50C2  E3A3 8076 ABDE 024B B3D1
- --------------------------------------------------
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1
>
> iQGcBAEBCgAGBQJUgK2+AAoJEB/kgVGp2CYv5RwMAI/Ddnsz7xVkl4NeQ+dMPvdI
> Rz6FT/T5FRg5LwUGlnUqSaGgFYnAmJayLqQX+tmnbLCtond2ug/LAaK3LrTcKYwu
> T7KKDEvcnat5EvExTkDhFuYyQoY/hfdVi7c6qXCCQ3YjkuoGFfNFrlukNTKWjjd+
> RnyiLLusKJRHYgg42EWeUC7McwL2B4wLHWmJlUpUNGBxA4o5u6TioZEIaX8XiaYI
> F0ln+6ZvwaOzWLFMt7IU/cCM2wh/FmMIXtp3Vb2a/JNGpuAb3QOyBANa9cXwQEhL
> f5XuEe0pkhxZzdhO8MzhCDh+/xxJMvQpkCOT4iD+Gt1CRGOPJUGjTdJDrxZWGhBn
> I1M7ZYVmc6HORWfGIYH2vKrkLvcNZiVdfZqgoXDAxsZp4SaNFK0XRrUhmniT8p4c
> akVUnMunPXqxtey/zeC9vOMDJntRDVoyngA3t/dW6b9mQthVkSkumMlrnzBvChVn
> 1k4RdGQ/H/uBDgMAH9+RVKV4dlZ7YF0bjba8VyfBFQ==
> =dFPt
> -----END PGP SIGNATURE-----

[Brandon Vincent]

On Thu, Dec 4, 2014 at 11:53 AM, Eric H. Christensen
<sparks(a)fedoraproject.org&gt; wrote:
>  There will always be a default and that default should be something
> sane that both provides protection and compatibility.  The current default leaves
> something to be desired with respect to security.  Using the recommendations provided by
> Mozilla you get both in a balanced way.  I could see the three recommended cipher suites
> lists being used as a low, default, and high security ratings within the CryptoPolicy.
I'm not a fan of specifying individual cipher suites.

OpenSSL accepts a wide variety of formats in regards to setting the
cipher preference. Specifying individual components such as the digest
or algorithm is cleaner in my opinion.

The following is from Qualys, "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM
EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384
EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW
!3DES !MD5 !EXP !PSK !SRP !DSS !RC4".

This provides a close equivalent to the Mozilla "modern"
recommendation. Adjustments to this preference for older browsers
would require adjustments permitting the use of weak algorithms (RC4
and 3DES) and older message digests (SHA-1).

Brandon Vincent

[Nikos Mavrogiannopoulos]

On Thu, 2014-12-04 at 10:56 -0500, Eric H. Christensen wrote:
>  The default settings for mod_ssl (for use in httpd) is:
>  SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5 
The default settings for mod ssl in F21 is the same as the system wide
policy.

[Hubert Kario]

On Thursday 04 December 2014 14:07:52 Brandon Vincent wrote:
>  On Thu, Dec 4, 2014 at 11:53 AM, Eric H. Christensen
>  
>  <sparks(a)fedoraproject.org&gt; wrote:
>  > There will always be a default and that default should be something sane
>  > that both provides protection and compatibility.  The current default
>  > leaves something to be desired with respect to security.  Using the
>  > recommendations provided by Mozilla you get both in a balanced way.  I
>  > could see the three recommended cipher suites lists being used as a low,
>  > default, and high security ratings within the CryptoPolicy.
>  I'm not a fan of specifying individual cipher suites.
>  
>  OpenSSL accepts a wide variety of formats in regards to setting the
>  cipher preference. Specifying individual components such as the digest
>  or algorithm is cleaner in my opinion. 
It just looks cleaner, but actually isn't.

We already had this kind of problem: old apache config file specified !ADH to 
disable the anonymous cipher suites. Now, what happens when you update openssl 
to support also ECDHE, which brings AECDH with it? You guessed it: apache now 
will happily negotiate anonymous cipher suites!

with a static list of ciphers there's no chance you'll get a surprise after 
updating components (because the order changed or new ciphers were added).

at the same time, you should check (and update as needed) your TLS server 
configs at least every time you change your certificates anyway.

-- 
Regards,
Hubert Kario
Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic

[Hubert Kario]

On Thursday 04 December 2014 10:56:54 Eric H. Christensen wrote:
>  The default settings for mod_ssl (for use in httpd) is:
>  
>  SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
>  
>  This isn't a great default (for many reasons). 
I'd say that making sure that
SSLCipherSuite DEFAULT
is secure would be better.

I've posted a suggestion to the openssl-dev list to change ordering and 
ciphers present in DEFAULT (as well as in HIGH, MEDIUM, LOW) - the only voices 
against were about removing RC4 ciphers from both DEFAULT and MEDIUM but given 
that we soon will have a RFC that disallows RC4 that should be a bit easier to 
push through (also, the RC4 use have fallen quite a bit since that time).

Unfortunately I don't have the time to work on code changes that this 
requires.

For now the CryptoPolicy is better.

-- 
Regards,
Hubert Kario
Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic