Forum Discussion
RayThomsen_7557
Nimbostratus
NimbostratusSSL Profile !EXPORT excludes what exactly?
Okay I found this page:
https://support.f5.com/kb/en-us/solutions/public/13000/100/sol13171.html
which tells me that !EXPORT will exclude "EXPORT grade (weak) ciphers" but I can't find a list of what that includes. Is there a list available?
Hi,the list of export ciphers:
tmm --clientciphers EXPORT ID SUITE BITS PROT METHOD CIPHER MAC KEYX 0: 100 EXP1024-RC4-SHA 56 SSL3 Native RC4 SHA RSA 1: 100 EXP1024-RC4-SHA 56 TLS1 Native RC4 SHA RSA 2: 98 EXP1024-DES-CBC-SHA 56 SSL3 Native DES SHA RSA 3: 98 EXP1024-DES-CBC-SHA 56 TLS1 Native DES SHA RSA 4: 98 EXP1024-DES-CBC-SHA 56 DTLS1 Native DES SHA RSA 5: 3 EXP-RC4-MD5 40 SSL3 Native RC4 MD5 RSA 6: 3 EXP-RC4-MD5 40 TLS1 Native RC4 MD5 RSA 7: 8 EXP-DES-CBC-SHA 40 SSL3 Native DES SHA RSA 8: 8 EXP-DES-CBC-SHA 40 TLS1 Native DES SHA RSA 9: 8 EXP-DES-CBC-SHA 40 DTLS1 Native DES SHA RSA
amolariCirrostratus
I couldn't find a list "as-is" of export-grade ciphers (even old/archived) googling (even by NIST). Generally speaking it's old, short keysized ciphers (typically 40bits)
https://www.owasp.org/index.php/Testing_for_SSL-TLS_%28OWASP-CM-001%29
Vitaliy_SavransNacreous
Hi,the list of export ciphers:
tmm --clientciphers EXPORT ID SUITE BITS PROT METHOD CIPHER MAC KEYX 0: 100 EXP1024-RC4-SHA 56 SSL3 Native RC4 SHA RSA 1: 100 EXP1024-RC4-SHA 56 TLS1 Native RC4 SHA RSA 2: 98 EXP1024-DES-CBC-SHA 56 SSL3 Native DES SHA RSA 3: 98 EXP1024-DES-CBC-SHA 56 TLS1 Native DES SHA RSA 4: 98 EXP1024-DES-CBC-SHA 56 DTLS1 Native DES SHA RSA 5: 3 EXP-RC4-MD5 40 SSL3 Native RC4 MD5 RSA 6: 3 EXP-RC4-MD5 40 TLS1 Native RC4 MD5 RSA 7: 8 EXP-DES-CBC-SHA 40 SSL3 Native DES SHA RSA 8: 8 EXP-DES-CBC-SHA 40 TLS1 Native DES SHA RSA 9: 8 EXP-DES-CBC-SHA 40 DTLS1 Native DES SHA RSA