用于 Java 的弱密码套件的良好列表
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/2238135/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Good list of weak cipher suites for Java
提问by John Smith
I'm running a server that requires a blacklist of weak cipher suites.
我正在运行一个需要弱密码套件黑名单的服务器。
So which of the following are weak? http://java.sun.com/javase/6/docs/technotes/guides/security/SunProviders.html#SunJSSEProvider
那么以下哪些是弱项？ http://java.sun.com/javase/6/docs/technotes/guides/security/SunProviders.html#SunJSSEProvider
采纳答案by Kevin
Why do you need to exclude the bad ones? Why not only include the good ones?
为什么你需要排除坏的？为什么不只包括好的？
For starters, I'd follow the NSA Suite Bguidelines, specifically RFC 5430
首先，我会遵循NSA Suite B指南，特别是RFC 5430
回答by slm
Versions after 7.0.2of Jetty now include a whitelist feature for cipher suites. Just add a section to your etc/jetty-ssl.xml like the following:
Jetty 7.0.2 之后的版本现在包括密码套件的白名单功能。只需在您的 etc/jetty-ssl.xml 中添加一个部分，如下所示：
<Call name="addConnector">
<Arg>
<New class="org.eclipse.jetty.server.ssl.SslSelectChannelConnector">
<Arg><Ref id="sslContextFactory" /></Arg>
<Set name="Port">8443</Set>
<Set name="maxIdleTime">30000</Set>
<Set name="Acceptors">2</Set>
<Set name="AcceptQueueSize">100</Set>
<!--you can enable cipher suites in the following section. -->
<Set name="IncludeCipherSuites">
<Array type="java.lang.String">
<Item>TLS_DHE_RSA_WITH_AES_128_CBC_SHA</Item>
<Item>SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA</Item>
<Item>TLS_RSA_WITH_AES_128_CBC_SHA</Item>
<Item>SSL_RSA_WITH_3DES_EDE_CBC_SHA</Item>
<Item>TLS_DHE_DSS_WITH_AES_128_CBC_SHA</Item>
<Item>SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA</Item>
</Array>
</Set>
</New>
</Arg>
</Call>
Doing so will automatically blacklist any cipher suites that aren't listed in this section.
这样做会自动将本节中未列出的任何密码套件列入黑名单。
回答by John Smith
Pretty sure Jetty is blacklist.
很确定 Jetty 是黑名单。
- http://docs.codehaus.org/display/JETTY/SSL+Cipher+Suites
- http://jira.codehaus.org/browse/JETTY-1164<-- I'm using slightly older version lol
- http://docs.codehaus.org/display/JETTY/SSL+Cipher+Suites
- http://jira.codehaus.org/browse/JETTY-1164<-- 我使用的是稍旧的版本，哈哈
Anyways my issue is solved. Thanks
反正我的问题解决了。谢谢
