Changes

Security - What is in a handshake

1,123 bytes added, 15:35, 2 March 2016

→‎ChangeCipherSpec

The server sends a complete encryption of the transaction to date, using the client public key and now data can begin to pass.

The current Cipher suite used on our entry point Lb's is as follows:

TLS/SSL_ECDHE_RSA_WITH_AES_128_GCM_SHA256

TLS/SSL_ECDHE_RSA_WITH_AES_256_GCM_SHA384

TLS/SSL_DHE_RSA_WITH_AES_128_GCM_SHA256

TLS/SSL_DHE_RSA_WITH_AES_256_GCM_SHA384

TLS/SSL_ECDHE_RSA_WITH_AES_128_CBC_SHA256

TLS/SSL_ECDHE_RSA_WITH_AES_128_CBC_SHA

TLS/SSL_ECDHE_RSA_WITH_AES_256_CBC_SHA384

TLS/SSL_ECDHE_RSA_WITH_AES_256_CBC_SHA

TLS/SSL_DHE_RSA_WITH_AES_128_CBC_SHA256

TLS/SSL_DHE_RSA_WITH_AES_128_CBC_SHA

TLS/SSL_DHE_DSS_WITH_AES_128_CBC_SHA256

TLS/SSL_DHE_RSA_WITH_AES_256_CBC_SHA256

TLS/SSL_DHE_DSS_WITH_AES_256_CBC_SHA256

TLS/SSL_DHE_DSS_WITH_AES_128_CBC_SHA

TLS/SSL_DHE_DSS_WITH_AES_256_CBC_SHA

TLS/SSL_DHE_RSA_WITH_AES_256_CBC_SHA

TLS/SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA

TLS/SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA

TLS/SSL_RSA_WITH_AES_128_GCM_SHA256

TLS/SSL_RSA_WITH_AES_256_GCM_SHA384

TLS/SSL_RSA_WITH_AES_128_CBC_SHA256

TLS/SSL_RSA_WITH_AES_256_CBC_SHA256

TLS/SSL_RSA_WITH_AES_128_CBC_SHA

TLS/SSL_RSA_WITH_AES_256_CBC_SHA.

The LoadBalancer will automatically choose a cipher in the encryption based on queue order and compatability.

= Security challenges =

348

edits