4

i have to get rid of the ciphers TLS_RSA_WITH_3DES_EDE_CBC_SHA and TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA since they are considered as weak in general and reported as weak by several security scan tools etc.

For that i've configured WebSphere Liberty to use TLSv1.2 which works so far. But unfortunately these ciphers are still supported by TLSv1.2 although WebSphere Liberty uses the security level of "HIGH" by default and even nmap displays "strong" for these ciphers.

This is where my confusion starts. Why are these ciphers considered strong by nmap and WebSphere Liberty but reported as "weak" by different security scan tools? What's correct and what's the easiest way to get rid of these in WebSphere Liberty without specifying a list of allowed ciphers manually?

andiveloper
  • 43
  • 1
  • 4
  • Such kind of questions is better suited for security.stackexchange.com. Also, you should probably not only say what tools consider the cipher as strong but also the ones which consider it weak, i.e. be more specific than "several security scan tools etc". – Steffen Ullrich Jun 06 '16 at 11:47

2 Answers2

3

If Nmap is reporting anything as "strong" then you are using an out-of-date version. The 6.49BETA release series in June of 2015 introduced a much-improved version of the ssl-enum-ciphers script that instead rates each ciphersuite along with the certificate strength to give an "A" - "F" score, similar to SSL Labs. The 3DES ciphersuites are assumed to have an effective key length of 112 bits, resulting in a maximum score of "C".

You can always get the latest version of Nmap at https://nmap.org/download.html

bonsaiviking
  • 5,825
  • 1
  • 20
  • 35
  • Thanks for that tip! nmap (version 7.12) provides now much more information and the two ciphers are rated C and D. Still wondering why WebSphere Liberty considers these ciphers as strong and enables these when using securityLevel "high" (which is the default). But that may be a question for IBM. – andiveloper Jun 07 '16 at 07:01
0

You could try banning 3DES using the jdk.tls.disabledAlgorithms IBM JDK facility:

https://www.ibm.com/support/knowledgecenter/SSYKE2_8.0.0/com.ibm.java.security.component.80.doc/security-component/jsse2Docs/disabledalgorithms.html

covener
  • 17,402
  • 2
  • 31
  • 45
  • Thanks! I was aware of that functionality but i would prefer a way to do it in WebSphere/the server.xml directly since the JDK could be replaced by a user/3rd party and then it would be enabled again. As written in my comment above: "i'm still wondering why WebSphere Liberty considers these ciphers as strong and enables these when using securityLevel 'high' (which is the default). But that may be a question for IBM." – andiveloper Jun 07 '16 at 07:04