diff options
| author | Bjørn Christian Seime <bjorncs@verizonmedia.com> | 2021-11-09 11:14:53 +0100 |
|---|---|---|
| committer | Bjørn Christian Seime <bjorncs@verizonmedia.com> | 2021-11-09 11:14:53 +0100 |
| commit | 836653a20a4ac4d76500835b31583e580b5b4be0 (patch) | |
| tree | a41dea542b9129988849856335893dc6239065cb /security-utils | |
| parent | f0b07d6a260e6ed24ca8433af6a57ec7226173dd (diff) | |
Disable ciphers that are only supported by some JDK-11 versions
Diffstat (limited to 'security-utils')
| -rw-r--r-- | security-utils/src/main/java/com/yahoo/security/tls/TlsContext.java | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/security-utils/src/main/java/com/yahoo/security/tls/TlsContext.java b/security-utils/src/main/java/com/yahoo/security/tls/TlsContext.java index 7923249a16e..b222c8664cc 100644 --- a/security-utils/src/main/java/com/yahoo/security/tls/TlsContext.java +++ b/security-utils/src/main/java/com/yahoo/security/tls/TlsContext.java @@ -24,17 +24,18 @@ public interface TlsContext extends AutoCloseable { * For TLSv1.2 we only allow RSA and ECDSA with ephemeral key exchange and GCM. * For TLSv1.3 we allow the DEFAULT group ciphers. * Note that we _only_ allow AEAD ciphers for either TLS version. + * + * TODO(bjorncs) Add new ciphers once migrated to JDK-17 (also available in 11.0.13): + * - TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 */ Set<String> ALLOWED_CIPHER_SUITES = Collections.unmodifiableSet(new HashSet<>(Arrays.asList( "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", - "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", // Java 12 - "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_AES_128_GCM_SHA256", // TLSv1.3 - "TLS_AES_256_GCM_SHA384", // TLSv1.3 - "TLS_CHACHA20_POLY1305_SHA256"))); // TLSv1.3, Java 12 + "TLS_AES_256_GCM_SHA384" // TLSv1.3 + ))); // TODO Enable TLSv1.3 after upgrading to JDK 17 Set<String> ALLOWED_PROTOCOLS = Collections.singleton("TLSv1.2"); |