Suscríbase al feed

This article was originally published on the Red Hat Customer Portal. The information may no longer be current.

Background

In the mid-1990s Secure Sockets Layer (SSL) was introduced for securing network communications.  The released version, version 2, contained several security holes and was quickly updated to version 3.  Transport Layer Security (TLS) became the next generation of PKI-based network encryption and was released in January of 1999.

Since the release of TLSv1, many changes have happened to both the development of TLS and the known attacks against the cryptographic protocol.  TLSv1.1 and TLSv1.2 were both released in the mid to late 2000s which fixed many problems seen in TLSv1 but, unfortunately, adoption was meager at best.  This left the door open to many attacks against the protocols in use (namely SSLv3 and TLSv1) including BEAST, CRIME, various cipher renegotiation and rollback attacks, and attacks on the RC4 encryption cipher.

Today, TLSv1.1 and TLSv1.2 are available in most products and fix many of the attack vectors we know SSL and TLSv1 are susceptible to.

BEAST

BEAST is an attack vector against TLS and, specifically, the symmetric encryption that occurs within the protocol.  While various fixes were put in place to help mitigate this attack (including turning off data compression) the one sure fix was to use a stream cipher instead of a block cipher.

RC4 Vulnerabilities

RC4 is the only stream cipher available for use in SSL and TLS and, thus, the only choice for mitigating the BEAST attack even though it has known weaknesses.  System administrators rushed to implement RC4 as their preferred cipher suite, sometimes eliminating all others in the process.  Unfortunately it was later determined that RC4 could be broken using an attack that was described as "feasible".  By this time, most Internet browsers had already implemented a fix for the BEAST  (n/n-1) vulnerability but with websites nearly forcing users to use the broken RC4 encryption cipher which puts users at risk.

Updates for RHEL 6.5

TLSv1.1 has fixed issues regarding BEAST and other attack vectors and TLSv1.2 has gone further by removing aging ciphers including MD5 and mostly removes SHA-1 algorithms implementations.  This is important since NIST has recommended that SHA-1, and prior hash functions, be discontinued after 2013.

As of the recent release of Red Hat Enterprise Linux (RHEL) 6.5 TLSv1.1 and TLSv1.2 are now available using OpenSSL 1.0.1.  That means that your Apache, and other implementations using OpenSSL, can start using TLSv1.1 and TLSv1.2 immediately!

Server

To utilize TLSv1.1 and TLSv1.2 in Apache a minor change to your SSLProtocol setting needs to be made.  By using either SSLProtocol all or SSLProtocol +SSLv3 +TLSv1 +TLSv1.1 +TLSv1.2 (for httpd version 2.2.23 and later) in your ssl.conf you'll be able to enable those new protocols.  By using the latter setting you'll be able to specify exactly which protocols you wish to use.

While we're in the ssl.conf file it's probably a good idea to take a look at the ciphers you are using.  The SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5 line should probably read something more like SSLCipherSuite HIGH:!aNULL:!MD5:!RC4.  This will remove ciphers that are more risky.

Client

TLSv1.1 and TLSv1.2 is now being tested in Mozilla's Firefox (version 25).  While not on by default, these protocols can be enabled by changing the security.tls.version.max configuration to "3" in the about:config settings.

So you can see that with a few minor modifications to your Apache configuration you too can be taking advantage of the latest encryption protocols.  This will go along way in protecting data being exchanged over your network or the Internet.


Sobre el autor

Red Hat is the world’s leading provider of enterprise open source software solutions, using a community-powered approach to deliver reliable and high-performing Linux, hybrid cloud, container, and Kubernetes technologies.


Red Hat helps customers integrate new and existing IT applications, develop cloud-native applications, standardize on our industry-leading operating system, and automate, secure, and manage complex environments. Award-winning support, training, and consulting services make Red Hat a trusted adviser to the Fortune 500. As a strategic partner to cloud providers, system integrators, application vendors, customers, and open source communities, Red Hat can help organizations prepare for the digital future.

Read full bio
UI_Icon-Red_Hat-Close-A-Black-RGB

Navegar por canal

automation icon

Automatización

Las últimas novedades en la automatización de la TI para los equipos, la tecnología y los entornos

AI icon

Inteligencia artificial

Descubra las actualizaciones en las plataformas que permiten a los clientes ejecutar cargas de trabajo de inteligecia artificial en cualquier lugar

open hybrid cloud icon

Nube híbrida abierta

Vea como construimos un futuro flexible con la nube híbrida

security icon

Seguridad

Vea las últimas novedades sobre cómo reducimos los riesgos en entornos y tecnologías

edge icon

Edge computing

Conozca las actualizaciones en las plataformas que simplifican las operaciones en el edge

Infrastructure icon

Infraestructura

Vea las últimas novedades sobre la plataforma Linux empresarial líder en el mundo

application development icon

Aplicaciones

Conozca nuestras soluciones para abordar los desafíos más complejos de las aplicaciones

Original series icon

Programas originales

Vea historias divertidas de creadores y líderes en tecnología empresarial