Advanced TLS

This topic contains additional information about TLS.

Tuning Protocol Version Availability

In release 8.5.1, as part of the transition to OpenSSL from RSA Bsafe, the behavior of the sec-protocol option has been modified. sec-protocol supports the following modes: SSLv23 (the default), SSLv3, TLSv1, TLSv11, and TLSv12.

Important

Starting from Genesys Security Pack 8.5.100.16, the default implementation supports only TLS version 1.1 or higher. Any attempt to set up SSLv3 or TLSv1 value using the sec-protocol option will result in an error. The default behavior (when an option is not set or set to SSLv23 explicitly) will always result in negotiation of a minimum of TLS 1.1.

The availability of a particular protocol setting in sec-protocol strongly depends on the actual component version. Older components may not support this option at all. No components except PSDK and the most recent Management Framework servers support the TLSv12 value.

Generally, the protocol versions currently available are as follows:

• On UNIX and Linux, TLS 1.2 is the highest available protocol with the OpenSSL Security Pack; TLS 1.1 with the RSA Security Pack.
• On Windows, TLS 1.1 and TLS 1.2 are supported starting with Microsoft Vista / Server 2008. However, in most cases these must be enabled in the registry to become available. Genesys recommends that you explicitly enable the desired protocol version in the Windows registry; refer to the Windows document TLS/SSL Settings for more information about enabling and disabling protocols in the Windows registry

Warning

Genesys components use the Windows implementation of TLS on Windows platforms, and therefore Windows settings take precedence over sec-protocol settings. Genesys software is unable to use a protocol version if it is disabled on the Windows operating system level.

The supported protocol version modes can be categorized as one of two types:

• strict mode—SSLv3, TLSv1, TLSv11, and TLSv12 are the strict protocol version modes. These settings can be used to enforce a specific protocol version. The connection will not be established if the remote server does not accept the enforced protocol version.
• compatibility mode—SSLv23, the default mode, is compatible with all modes from SSLv2 up to and including TLSv12, and will connect with the highest mode offered by the other server. If SSLv2 ciphers are explicitly specified, the SSLv2 client can connect only to servers running in SSLv23 mode. Otherwise, the SSLv2 mode is deprecated; but it is highly vulnerable and is not recommended.

Tuning Available Cipher Lists

Normally, the set of available ciphers is provided by your InfoSec, and can be configured to the preferences of the user. The cipher-list configuration option allows the supporting Genesys component to select a list of cipher suites used in TLS. This option is transferred to a third-party library and describes the set of possible cipher suites.

Cipher List Formatting Rules

Important

This section describes cipher list format for an application using the Genesys common library. If you are configuring a cipher list for the PSDK-based application, refer to the Platform SDK Developer's Guide for the proper format, and more information about cipher lists in PSDK.

Question: Do these rules and the format apply equally to Windows and *nix?

For applications using the Genesys common library (From Colin: How will the customer know if they are using an application that uses the common library?), the cipher list string is a list of cipher operations. Each operation consists of an optional operator character followed by a name. Cipher list strings must conform to the following formatting rules:

[+] Show rules

• The name is either a valid cipher name or a cipher alias. Valid names contain the characters a-z, A-Z, 0-9, and - (dash). Question: Should this be a dash or an underscore? Colin: I think this can be full specification of cipher list to use, like TLS_ECDH_AES256_SHA
• List separator characters are used to separate the names and aliases in the list. A list separator character must be a colon.
• Multi-part names are joined with +.
• The character ! appearing immediately after a separator indicates a kill operation. The cipher following the character becomes unavailable.
• The character + appearing immediately after a separator indicates an order operation. This moves the active cipher to the current position in the list of ciphers.
• The character - appearing immediately after a separator indicates a delete operation. The cipher following the character becomes inactive. The cipher remains available for further operations.
• A non-operator character appearing immediately after a separator indicates an add operation. If the cipher following the character is not currently active, the cipher is added as an active cipher to the end of the list of available ciphers.

All operations occur in the order in which they appear in the list. If the cipher corresponding to a name (or part of a name, for multi-part names) is not available in the library, it is ignored during loading. In this situation, no error message is logged.

Note: Colin has many questions for these tables.

Aliases

Ciphers also have aliases. The following table details the primary cipher aliases.

[+] Show table

Alias	Description
kRSA, kDHr, kDHd, kEDH	Key exchange types Colin: Are there really 'k' and 'a' characters in front of these alias names? The example below does not have "kRSA" just "RSA"
aRSA, aDSS, aNULL, aDH	Authentication
DES, 3DES, RC4, RC2, eNULL	Ciphers
MD5, SHA1	Message digests

Groups of commonly-used ciphers also have aliases. This enables multiple aliases to be specified easily. The following table details the cipher group aliases.

[+] Show table

Alias	Description
SSLv2	All SSLv2 ciphers
SSLv3	All SSLv3 ciphers
EXP	All export ciphers
LOW	All low strength ciphers (no export ciphers, normally single DES)
MEDIUM	128-bit encryption
HIGH	Triple DES Colin: openSSL no longer includes 3DES in HIGH and I think there is more included in high (like AES).

Aliases can also be joined in a colon-separated list to specify the ciphers to add, move, or delete.

Example

The following is an example of a cipher string:

!ADH:RC4+RSA:HIGH:MEDIUM:LOW:EXP:+SSLv2:+EXP

This cipher string is interpreted in the following sequence:

1. Do not consider any ciphers that do not authenticate.
2. Use ciphers that use RC4 and RSA.
3. Include the HIGH, MEDIUM, and LOW security ciphers.
4. Add all export ciphers.
5. Pull all SSLv2 and export ciphers to the end of the list.