Groups > comp.lang.java.programmer > #34143

One for the encryption experts

From	Duncan Idaho <duncan@dunenoemail.com>
Newsgroups	comp.lang.java.programmer
Subject	One for the encryption experts
Date	2016-04-15 16:23 +0100
Organization	A noiseless patient Spider
Message-ID	<ner0r1$7j1$1@dont-email.me> (permalink)

Show all headers | View raw

Hi

The Question is:

Am I going insane,and, if not, does anyone have any idea how to fix the 
problem described below.

(I'm also going to post this to the Tomcat list)

Let me say straight away I am no cipher/encryption expert, I'm not even 
sure I'm using the right terminology but here goes anyway.

I have an ssl certificate installed for apache-tomcat-7.0.42 running  as 
a standalone web server on port 80, it's been this way for the past 
three years and it does fine although I've only just got the cert.

It all works apart from the key exchange which the Chrome browser 
bitches about. It tells me that the server uses RSA as the key exchange 
mechanism and it's not happy about that.

It used to run under Java 1.7.0_45 but in an attempt to fix problems 
with the key exchange cipher suite I now have it running under
Java 1.8.0_77-b03. The processor architecture is i586 and tomcat is 
hosted on CentOS by a large hosting company.

The cipher it should use is ECDHE_RSA, I know this because I have the 
same version of Tomcat using the same version of Java 1.8.0_77-b03 but 
for the x64 processor architecture on my home network running on Ubuntu 
Linux, Chrome is quite happy with this cipher apparently.

The really bizarre thing is that ECDHE ciphers are available for the x64 
architecture but not for the i586 architecture. Is this really the case 
or am I actually going insane.

Thanks and mind you don't damage your brain reading the following.
That's all I have to say, the rest of this message is geek soup.

Oh yes

I found a small Java program online that prints out the default cipher 
suits for a given Java installation. I believe it's been written by one 
of the guys from the Tomcat mailing list. I've tacked the code on at the 
end. First the remote server, no ECHDE ciphers in either distro

jdk1.7.0_45_i586

Default	Cipher
  	SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA
*	SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
  	SSL_DHE_DSS_WITH_DES_CBC_SHA
  	SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA
*	SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
  	SSL_DHE_RSA_WITH_DES_CBC_SHA
  	SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA
  	SSL_DH_anon_EXPORT_WITH_RC4_40_MD5
  	SSL_DH_anon_WITH_3DES_EDE_CBC_SHA
  	SSL_DH_anon_WITH_DES_CBC_SHA
  	SSL_DH_anon_WITH_RC4_128_MD5
  	SSL_RSA_EXPORT_WITH_DES40_CBC_SHA
  	SSL_RSA_EXPORT_WITH_RC4_40_MD5
*	SSL_RSA_WITH_3DES_EDE_CBC_SHA
  	SSL_RSA_WITH_DES_CBC_SHA
  	SSL_RSA_WITH_NULL_MD5
  	SSL_RSA_WITH_NULL_SHA
*	SSL_RSA_WITH_RC4_128_MD5
*	SSL_RSA_WITH_RC4_128_SHA
*	TLS_DHE_DSS_WITH_AES_128_CBC_SHA
*	TLS_DHE_DSS_WITH_AES_128_CBC_SHA256
*	TLS_DHE_RSA_WITH_AES_128_CBC_SHA
*	TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
  	TLS_DH_anon_WITH_AES_128_CBC_SHA
  	TLS_DH_anon_WITH_AES_128_CBC_SHA256
*	TLS_EMPTY_RENEGOTIATION_INFO_SCSV
  	TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5
  	TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA
  	TLS_KRB5_EXPORT_WITH_RC4_40_MD5
  	TLS_KRB5_EXPORT_WITH_RC4_40_SHA
  	TLS_KRB5_WITH_3DES_EDE_CBC_MD5
  	TLS_KRB5_WITH_3DES_EDE_CBC_SHA
  	TLS_KRB5_WITH_DES_CBC_MD5
  	TLS_KRB5_WITH_DES_CBC_SHA
  	TLS_KRB5_WITH_RC4_128_MD5
  	TLS_KRB5_WITH_RC4_128_SHA
*	TLS_RSA_WITH_AES_128_CBC_SHA
*	TLS_RSA_WITH_AES_128_CBC_SHA256
  	TLS_RSA_WITH_NULL_SHA256

jdk1.8.0_77_i586

Default	Cipher
  	SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA
*	SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
  	SSL_DHE_DSS_WITH_DES_CBC_SHA
  	SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA
*	SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
  	SSL_DHE_RSA_WITH_DES_CBC_SHA
  	SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA
  	SSL_DH_anon_WITH_3DES_EDE_CBC_SHA
  	SSL_DH_anon_WITH_DES_CBC_SHA
  	SSL_RSA_EXPORT_WITH_DES40_CBC_SHA
*	SSL_RSA_WITH_3DES_EDE_CBC_SHA
  	SSL_RSA_WITH_DES_CBC_SHA
  	SSL_RSA_WITH_NULL_MD5
  	SSL_RSA_WITH_NULL_SHA
*	TLS_DHE_DSS_WITH_AES_128_CBC_SHA
*	TLS_DHE_DSS_WITH_AES_128_CBC_SHA256
*	TLS_DHE_DSS_WITH_AES_128_GCM_SHA256
*	TLS_DHE_RSA_WITH_AES_128_CBC_SHA
*	TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
*	TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
  	TLS_DH_anon_WITH_AES_128_CBC_SHA
  	TLS_DH_anon_WITH_AES_128_CBC_SHA256
  	TLS_DH_anon_WITH_AES_128_GCM_SHA256
*	TLS_EMPTY_RENEGOTIATION_INFO_SCSV
  	TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5
  	TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA
  	TLS_KRB5_WITH_3DES_EDE_CBC_MD5
  	TLS_KRB5_WITH_3DES_EDE_CBC_SHA
  	TLS_KRB5_WITH_DES_CBC_MD5
  	TLS_KRB5_WITH_DES_CBC_SHA
*	TLS_RSA_WITH_AES_128_CBC_SHA
*	TLS_RSA_WITH_AES_128_CBC_SHA256
*	TLS_RSA_WITH_AES_128_GCM_SHA256
  	TLS_RSA_WITH_NULL_SHA256


My home network with exactly the same release but for the x64 processor 
architecture

jdk1.8.0_77_x64 with ECHDE

Default	Cipher
  	SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA
*	SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
  	SSL_DHE_DSS_WITH_DES_CBC_SHA
  	SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA
*	SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
  	SSL_DHE_RSA_WITH_DES_CBC_SHA
  	SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA
  	SSL_DH_anon_WITH_3DES_EDE_CBC_SHA
  	SSL_DH_anon_WITH_DES_CBC_SHA
  	SSL_RSA_EXPORT_WITH_DES40_CBC_SHA
*	SSL_RSA_WITH_3DES_EDE_CBC_SHA
  	SSL_RSA_WITH_DES_CBC_SHA
  	SSL_RSA_WITH_NULL_MD5
  	SSL_RSA_WITH_NULL_SHA
*	TLS_DHE_DSS_WITH_AES_128_CBC_SHA
*	TLS_DHE_DSS_WITH_AES_128_CBC_SHA256
*	TLS_DHE_DSS_WITH_AES_128_GCM_SHA256
*	TLS_DHE_RSA_WITH_AES_128_CBC_SHA
*	TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
*	TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
  	TLS_DH_anon_WITH_AES_128_CBC_SHA
  	TLS_DH_anon_WITH_AES_128_CBC_SHA256
  	TLS_DH_anon_WITH_AES_128_GCM_SHA256
*	TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
*	TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
*	TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
*	TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
  	TLS_ECDHE_ECDSA_WITH_NULL_SHA
*	TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
*	TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
*	TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
*	TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
  	TLS_ECDHE_RSA_WITH_NULL_SHA
*	TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
*	TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
*	TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
*	TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
  	TLS_ECDH_ECDSA_WITH_NULL_SHA
*	TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
*	TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
*	TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
*	TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256
  	TLS_ECDH_RSA_WITH_NULL_SHA
  	TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA
  	TLS_ECDH_anon_WITH_AES_128_CBC_SHA
  	TLS_ECDH_anon_WITH_NULL_SHA
*	TLS_EMPTY_RENEGOTIATION_INFO_SCSV
  	TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5
  	TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA
  	TLS_KRB5_WITH_3DES_EDE_CBC_MD5
  	TLS_KRB5_WITH_3DES_EDE_CBC_SHA
  	TLS_KRB5_WITH_DES_CBC_MD5
  	TLS_KRB5_WITH_DES_CBC_SHA
*	TLS_RSA_WITH_AES_128_CBC_SHA
*	TLS_RSA_WITH_AES_128_CBC_SHA256
*	TLS_RSA_WITH_AES_128_GCM_SHA256
  	TLS_RSA_WITH_NULL_SHA256



=================== code ==================

import java.util.Iterator;
import java.util.Map;
import java.util.TreeMap; import javax.net.ssl.SSLServerSocketFactory;

public class SSLInfo { public static void main(String[] args) throws
Exception { SSLServerSocketFactory ssf =
(SSLServerSocketFactory)SSLServerSocketFactory.getDefault();

String[] defaultCiphers = ssf.getDefaultCipherSuites(); String[]
availableCiphers = ssf.getSupportedCipherSuites();

TreeMap ciphers = new TreeMap();

for(int i=0; i<availableCiphers.length; ++i )
ciphers.put(availableCiphers[i], Boolean.FALSE);

for(int i=0; i<defaultCiphers.length; ++i )
ciphers.put(defaultCiphers[i], Boolean.TRUE);

System.out.println("Default\tCipher"); for(Iterator i =
ciphers.entrySet().iterator(); i.hasNext(); ) { Map.Entry
cipher=(Map.Entry)i.next();

if(Boolean.TRUE.equals(cipher.getValue())) System.out.print('*'); else
System.out.print(' ');

System.out.print('\t'); System.out.println(cipher.getKey()); } } }


-- 
Duncan Idaho

Back to comp.lang.java.programmer | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

One for the encryption experts Duncan Idaho <duncan@dunenoemail.com> - 2016-04-15 16:23 +0100
  Re: One for the encryption experts Robert Klemme <shortcutter@googlemail.com> - 2016-04-16 11:49 +0200
    Re: One for the encryption experts Nemo <nemo@invalid.invalid> - 2016-04-16 08:44 -0400
      Re: One for the encryption experts Duncan Idaho <duncan@dunenoemail.com> - 2016-04-16 16:03 +0100
        Re: One for the encryption experts Robert Klemme <shortcutter@googlemail.com> - 2016-04-16 17:13 +0200
          Re: One for the encryption experts Duncan Idaho <duncan@dunenoemail.com> - 2016-04-16 17:42 +0100

csiph-web