Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Generic User Avatar

Cipher Suites


  • Please log in to reply
8 replies to this topic

#1 supertopsecret

supertopsecret

  •  Avatar image
  • Members
  • 35 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:53 AM

Posted 26 November 2023 - 03:50 AM

     Good morning? How do I get all of these cipher suites to show as forward secrecy? Also, Ssl 3 and 2 seem to be missing?

Attached Files



BC AdBot (Login to Remove)

 


#2 h_b_s

h_b_s

  •  Avatar image
  • Members
  • 105 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:53 PM

Posted 26 November 2023 - 04:27 AM

Question one:  You don't.

https://en.wikipedia.org/wiki/Forward_secrecy#Protocols

I recommend you read the whole article, however, because if you actually understood what forward secrecy is and how it works you wouldn't have asked.

Question two:  SSL as a protocol has been obsolete for at least 10 probably closer to 15 years.  It's been removed from or disabled in most libraries at this point.



#3 supertopsecret

supertopsecret
  • Topic Starter

  •  Avatar image
  • Members
  • 35 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:53 AM

Posted 26 November 2023 - 11:49 AM

     Good morning, Mr. H_b_s? Anybody can alter a wikipedia page? I always change African-Americans who have their ethnicity as black back to African-American?

Question one:  You don't.

https://en.wikipedia.org/wiki/Forward_secrecy#Protocols

I recommend you read the whole article, however, because if you actually understood what forward secrecy is and how it works you wouldn't have asked.

Question two:  SSL as a protocol has been obsolete for at least 10 probably closer to 15 years.  It's been removed from or disabled in most libraries at this point.

 

How do I mark this post as resolved?


Edited by supertopsecret, 26 November 2023 - 11:51 AM.


#4 Win11DataSavior

Win11DataSavior

  •  Avatar image
  • Members
  • 31 posts
  • OFFLINE
  •  
  • Local time:10:23 AM

Posted 30 November 2023 - 06:58 AM

To enable forward secrecy (FS) for all cipher suites and disable SSLv2 and SSLv3:

  1. Locate the OpenSSL configuration file: locate openssl.cnf

  2. Open the configuration file: sudo nano /etc/ssl/openssl.cnf

  3. In the [cipher_suites] section, replace the existing list of cipher suites with:

[cipher_suites] TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
  1. Save the changes and restart the OpenSSL service: sudo service ssl restart

  2. Verify the changes: openssl ciphers -a

Let me know if you need any further asssistance. Have a nice day.



#5 supertopsecret

supertopsecret
  • Topic Starter

  •  Avatar image
  • Members
  • 35 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:53 AM

Posted 30 November 2023 - 09:01 AM

 

To enable forward secrecy (FS) for all cipher suites and disable SSLv2 and SSLv3:

  1. Locate the OpenSSL configuration file: locate openssl.cnf

  2. Open the configuration file: sudo nano /etc/ssl/openssl.cnf

  3. In the [cipher_suites] section, replace the existing list of cipher suites with:

[cipher_suites] TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256
  1. Save the changes and restart the OpenSSL service: sudo service ssl restart

  2. Verify the changes: openssl ciphers -a

Let me know if you need any further asssistance. Have a nice day.

 

     Good morning. What application do I use to open it? I'm not seeing the cipher_suite section? Are you able to just attach me your copy for me to upload? Can we also get it as a Mobile certificate to install? Same as the one in the folder? Except one that allows all of them to activate? Also, for the new Macs, sudo service ssl restart doesn't work anymore? Some of the codes change such as with dns cache flushing. Somebody else mentioned that your code seems for Linux. Although the sudo nano string worked. Another commentator posted how that it's more for the browser developers to have to worry about that instead.

Attached Files


Edited by supertopsecret, 30 November 2023 - 07:42 PM.


#6 sflatechguy

sflatechguy

  •  Avatar image
  • BC Advisor
  • 2,751 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:53 AM

Posted 02 December 2023 - 03:42 PM

If you insist on opening and editing the config file, you should be able to open it with any text editor, or the vi command line tool.

Most Linux command will work on Mac, as the Mac OS is based on BSD, which is part of the wider *nix family of operating systems. 

I'm wondering why you would want to change the defaults cipher suites.



#7 supertopsecret

supertopsecret
  • Topic Starter

  •  Avatar image
  • Members
  • 35 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:53 AM

Posted 03 December 2023 - 03:22 AM

If you insist on opening and editing the config file, you should be able to open it with any text editor, or the vi command line tool.

Most Linux command will work on Mac, as the Mac OS is based on BSD, which is part of the wider *nix family of operating systems. 

I'm wondering why you would want to change the defaults cipher suites.

     Good morning. The screenshots will show why I want to change the default cipher suites. It's to enable forward secrecy. I opened it via the text editor and using the terminal. There wasn't a cipher suite name to be able to do that?



#8 sflatechguy

sflatechguy

  •  Avatar image
  • BC Advisor
  • 2,751 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:53 AM

Posted 03 December 2023 - 10:59 AM

No.  As Win11DataSavior pointed out, the cypher suites are configured in the openssl.cnf file.

I ask because it appears you are a bit unsure about how the cypher suites are configured and how forward secrecy works. On a Mac, you should just be able to go with the defaults, unless you are sure you know what you are doing.



#9 cryptodan

cryptodan

    Bleepin Madman


  •  Avatar image
  • Members
  • 35,210 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:04:53 AM

Posted 09 December 2023 - 06:07 PM

     Good morning? How do I get all of these cipher suites to show as forward secrecy? Also, Ssl 3 and 2 seem to be missing?


What site did you test to pull the ssl ciphers?

US Navy Veteran from 2002 to 2006

Masters in Computer and Digital Forensics Expert - Stevenson University Alumni 2015

Arch Desktop - https://termbin.com/epij

Arch Laptop - https://www.termbin.com/dnwk

Ubuntu Server - https://termbin.com/zvra





1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users