0

Per https://java.com/en/configure_crypto.html, the website says that "For TLS 1.3, TLS_AES_256_GCM_SHA384 will now be preferred over TLS_AES_128_GCM_SHA256." but with the later updates TLS_AES_256_GCM_SHA384 is no longer available as supported suites.

Is there a way to enable more suites than the default enabled ones? Such as TLS_CHACHA20_POLY1305_SHA256 which was added and enabled in update 204; but no longer in the latest update.

Cipher Suites dump on 1.8 update 301

 1. TLS_AES_256_GCM_SHA384
 2. TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
 3. TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
 4. TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
 5. TLS_RSA_WITH_AES_256_GCM_SHA384
 6. TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
 7. TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
 8. TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
 9. TLS_DHE_DSS_WITH_AES_256_GCM_SHA384
 10. TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
 11. TLS_RSA_WITH_AES_128_GCM_SHA256
 12. TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
 13. TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256
 14. TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
 15. TLS_DHE_DSS_WITH_AES_128_GCM_SHA256
 16. TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
 17. TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
 18. TLS_RSA_WITH_AES_256_CBC_SHA256
 19. TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
 20. TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
 21. TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
 22. TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
 23. TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
 24. TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
 25. TLS_RSA_WITH_AES_256_CBC_SHA
 26. TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
 27. TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
 28. TLS_DHE_RSA_WITH_AES_256_CBC_SHA
 29. TLS_DHE_DSS_WITH_AES_256_CBC_SHA
 30. TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
 31. TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
 32. TLS_RSA_WITH_AES_128_CBC_SHA256
 33. TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
 34. TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
 35. TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
 36. TLS_DHE_DSS_WITH_AES_128_CBC_SHA256
 37. TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
 38. TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
 39. TLS_RSA_WITH_AES_128_CBC_SHA
 40. TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
 41. TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
 42. TLS_DHE_RSA_WITH_AES_128_CBC_SHA
 43. TLS_DHE_DSS_WITH_AES_128_CBC_SHA
 44. TLS_EMPTY_RENEGOTIATION_INFO_SCSV

Cipher Suites dump on 1.8 update 311

 1. TLS_AES_128_GCM_SHA256
 2. TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
 3. TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
 4. TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
 5. TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
 6. TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
 7. TLS_DHE_DSS_WITH_AES_256_GCM_SHA384
 8. TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
 9. TLS_DHE_DSS_WITH_AES_128_GCM_SHA256
 10. TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
 11. TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
 12. TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
 13. TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
 14. TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
 15. TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
 16. TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
 17. TLS_DHE_DSS_WITH_AES_128_CBC_SHA256
 18. TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
 19. TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
 20. TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
 21. TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256
 22. TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
 23. TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
 24. TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
 25. TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
 26. TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
 27. TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
 28. TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
 29. TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
 30. TLS_DHE_RSA_WITH_AES_256_CBC_SHA
 31. TLS_DHE_DSS_WITH_AES_256_CBC_SHA
 32. TLS_DHE_RSA_WITH_AES_128_CBC_SHA
 33. TLS_DHE_DSS_WITH_AES_128_CBC_SHA
 34. TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
 35. TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
 36. TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
 37. TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
 38. TLS_RSA_WITH_AES_256_GCM_SHA384
 39. TLS_RSA_WITH_AES_128_GCM_SHA256
 40. TLS_RSA_WITH_AES_256_CBC_SHA256
 41. TLS_RSA_WITH_AES_128_CBC_SHA256
 42. TLS_RSA_WITH_AES_256_CBC_SHA
 43. TLS_RSA_WITH_AES_128_CBC_SHA
 44. TLS_EMPTY_RENEGOTIATION_INFO_SCSV
Zera42
  • 2,592
  • 1
  • 21
  • 33
  • On my 8u301 and 8u311 the default enabled list is 45 entries, numbered 0 to 44. You appear to be printing #1-44 but not #0 which omits TLS_AES_128_GCM_SHA256 in 8u301 and TLS_AES_256_GCM_SHA384 in 8u311. Do you mean an update 204 to 8 and if so where did you see it? I check the Oracle website every month and I got 8u201,202 in Jan '19 and 8u211,212 in May '19 but nothing in between, neither is there any such version in www.oracle.com/java/technologies/downloads/archive/ now, and no 8 I've ever seen had CHACHA. – dave_thompson_085 Apr 13 '22 at 12:36
  • @dave_thompson_085 https://bugs.openjdk.java.net/browse/JDK-8240229?jql=project%20%3D%20JDK%20AND%20fixVersion%20%3D%20%2212%22; but it may be openjdk that it was backported on. I may have misread though; going through the logs; it may have just been for jdk 11. Also you're right on the 45 entries; I accidentally started the for loop with a 1; it's interesting how okhttp supports https://square.github.io/okhttp/3.x/okhttp/okhttp3/CipherSuite.html#TLS_CHACHA20_POLY1305_SHA256; not sure if it's on java8 or only higher. Ill look into this. – Zera42 Apr 13 '22 at 20:56

1 Answers1

0

I had this exact same issue a while ago - I downloaded the very latest version of Java OpenJDK to replace my current version and when I checked the ciphers TLS_AES_256_GCM_SHA384 was missing. I tried different versions of Java from Amazon and AdoptOpenJDK and they were all missing TLS_AES_256_GCM_SHA384 despite it being the listed on their web sites as being supported. It turned out that tracking down the cause was rather simple. I'm keeping the instructions below rather generic as you may be using Windows/Linux but the principle is the key thing here.

  • Firstly, download the latest Java version e.g. 1.8.0_342 to a temporary folder (I download the .zip file rather than the .msi file).

  • Extract the zip file

  • Go to the \bin folder

  • Run this one line command to list all the ciphers in this new java version

    jrunscript -e "java.util.Arrays.asList(javax.net.ssl.SSLServerSocketFactory.getDefault().getSupportedCipherSuites()).stream().forEach(println)"

  • This will produce a list of the ciphers e.g.

TLS_AES_256_GCM_SHA384
TLS_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
TLS_DHE_DSS_WITH_AES_256_GCM_SHA384
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
TLS_DHE_DSS_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
TLS_DHE_DSS_WITH_AES_128_CBC_SHA256
TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_DHE_DSS_WITH_AES_256_CBC_SHA
TLS_DHE_RSA_WITH_AES_128_CBC_SHA
TLS_DHE_DSS_WITH_AES_128_CBC_SHA
TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_AES_256_GCM_SHA384
TLS_RSA_WITH_AES_128_GCM_SHA256
TLS_RSA_WITH_AES_256_CBC_SHA256
TLS_RSA_WITH_AES_128_CBC_SHA256
TLS_RSA_WITH_AES_256_CBC_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_EMPTY_RENEGOTIATION_INFO_SCSV
TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
TLS_ECDHE_RSA_WITH_RC4_128_SHA
SSL_RSA_WITH_RC4_128_SHA
TLS_ECDH_ECDSA_WITH_RC4_128_SHA
TLS_ECDH_RSA_WITH_RC4_128_SHA
SSL_RSA_WITH_RC4_128_MD5
SSL_RSA_EXPORT_WITH_RC4_40_MD5
TLS_KRB5_WITH_RC4_128_SHA
TLS_KRB5_WITH_RC4_128_MD5
TLS_KRB5_EXPORT_WITH_RC4_40_SHA
TLS_KRB5_EXPORT_WITH_RC4_40_MD5\

  • This new Java version does contain TLS_AES_256_GCM_SHA384 as expected
  • Therefore my old Java that is used by my app, must not have been updated correctly when I last upgraded it (files in use by the app possibly).
  • Stop any process that is using the old Java version, and delete the contents of the old java folder including subfolders
  • Copy over the new Java version from the temporary area.
  • Start the app as normal and check for any handshake errors.
  • Go the area that you just copied the new Java version into and in the \bin folder repeat the same one liner to check the cipher list - it should still have TLS_AES_256_GCM_SHA384 listed.

So a rather simple fix - just make sure when you install the new Java version that you completely erase the old folder contents first.

zoomzoomvince
  • 239
  • 1
  • 5
  • 14