CBC ciphers in relation to RFC7366 Encrypt-then-MAC
Good morning, there is a recommendation from German federal security office to still allow CBC-mode ciphers as long as TLS extention "Encrypt-then-MAC" (RFC7366) is in use. But I can't find any information how F5 currently behaves in this regards. Is there any special setting we have to care about or is this already active by default? For your reference, we are running 15.1.8. Can someone share some more details here? And what are your recommendations/experiences with CBC-mode ciphers? Thank you! Regards Stefan 🙂Solved2KViews1like13CommentsLightboard Lessons: What Are AEAD Ciphers?
The recent TLS 1.3 protocol mandates that Authenticated Encryption with Associated Data (AEAD) Ciphers be used for bulk encryption. As web servers and browsers transition to using these ciphers, it's important to know what they are and how they work. In this video, John discusses the details of AEAD Ciphers and which ones you can use to implement on your web server. Related Resources: Explaining TLS 1.3 How To Choose An Authenticated Encryption Mode (blog by Professor Matthew Green) SSL/TLS ciphers supported on BIG-IP platforms NIST List of Authenticated Encryption Modes1.4KViews0likes0CommentsHow to find which cipher suit is used or not?
For example we have cipher suite as below ECDHE-RSA-AES128-GCM-SHA256 (0xc02f) SHA256 ECDHE-RSA-AES128-CBC-SHA (0xc013) SHA ECDHE-RSA-AES128-SHA256 (0xc027) SHA256 How can we know which cipher suit is used or not used? Can we see how many times that cipher suit is using? I saw F5 keep statistic about ssl exchange key algorithm (ECDHE, DES, etc) but no statistics about specific cipher suit.1.2KViews0likes1CommentCipher negotiated between F5 and Node
Hi There, We are currently in the process of upgrading F5 from v12 to v13. We came across an issue due to depreciated ciphers. Some of our VIPs were using the DEFAULT cipher suite and since some legacy ciphers were depreciated in the new version, caused an outage for us. In order to mitigate this issue in future upgrades is there any way to check all the ciphers negotiated between the F5 and Nodes before hand, hence we can verify this against the supported ciphers in the latest version. Appreciate any other solutions that can mitigate the issue for our scenario. Thanks in Advance CheersSolved1.1KViews0likes6CommentsCipher string mismatch ??
Hi, I configured SSL cipher string, to support 6 different ciphers: config tmm --clientciphers TLSv1_2+ECDH-RSA-AES256-GCM-SHA384:TLSv1_2+ECDH-RSA-AES256-SHA384:TLSv1_2+ECDH-RSA-AES256-SHA:TLSv1_2+DHE-RSA-AES256-SHA256:TLSv1_2+DHE-RSA-AES256-SHA:TLSv1_2+DHE-RSA-AES256-GCM-SHA384 ID SUITE BITS PROT METHOD CIPHER MAC KEYX 0: 49202 ECDH-RSA-AES256-GCM-SHA384 256 TLS1.2 Native AES-GCM SHA384 ECDH_RSA 1: 49194 ECDH-RSA-AES256-SHA384 256 TLS1.2 Native AES SHA384 ECDH_RSA 2: 49167 ECDH-RSA-AES256-SHA 256 TLS1.2 Native AES SHA ECDH_RSA 3: 107 DHE-RSA-AES256-SHA256 256 TLS1.2 Native AES SHA256 EDH/RSA 4: 57 DHE-RSA-AES256-SHA 256 TLS1.2 Native AES SHA EDH/RSA 5: 159 DHE-RSA-AES256-GCM-SHA384 256 TLS1.2 Native AES-GCM SHA384 EDH/RSA I used that string in ClientSSL profile, but when I tested my page with SSLlabs, only ciphers 3,4,5 are supported. Any idea where is the problem?? Best regards, Spella712Views0likes5CommentsDisable ECDHE Cipher Suite for Server Side SSL Profile
Hi, We have deployed Imperva WAF in transparent bridge mode between our F5 load balancers and Web Servers. In order to perform SSL Decryption, we need to disable certain Cipher Suites including ECHDE and EDH. I have configured the following below but am still getting warnings on the WAF that cipher ** TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA** cannot be decrypted. Current SSL Server Profile: ** DEFAULT:!SSLv3:!ECDHE:!EDH ** What else is missing in order to disable cipher ** TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA ** ? Thanks for your help!699Views0likes2CommentsHow to build very specific Cipher string?
How can I specify a very specific Cipher string? The object is to only allow the ciphers below and offer them in this specific order. TLS13-AES256-GCM-SHA384/TLS1.3 TLS13-CHACHA20-POLY1305-SHA256/TLS1.3 TLS13-AES128-GCM-SHA256/TLS1.3 ECDHE-ECDSA-AES256-GCM-SHA384/TLS1.2 ECDHE-ECDSA-CHACHA20-POLY1305-SHA256/TLS1.2 ECDHE-ECDSA-AES128-GCM-SHA256/TLS1.2 ECDHE-RSA-AES256-GCM-SHA384/TLS1.2 ECDHE-RSA-CHACHA20-POLY1305-SHA256/TLS1.2 ECDHE-RSA-AES128-GCM-SHA256/TLS1.2 ECDHE-RSA-AES256-CBC-SHA/TLS1.2 ECDHE-RSA-AES128-CBC-SHA/TLS1.2 Is this possible at all?620Views0likes3CommentsSSL Cipher error in ltm logfile "Cipher XX:Y negotiated is not configured in profile <sslprofilename>"
I recently moved an HTTPS Virtual Server from an old LTM (running 9.3.1) to a new pair of load balancers running 11.4.1. This particular Virtual Server is using both a client SSL profile and a server SSL profile, pointing at a pool with a single node. Everything seems to be working with my various browser testing. However, I'm seeing log lines in /var/log/ltm such as the following: Nov 7 08:10:33 bigip7 err tmm4[12863]: 01260014:3: Cipher 16:2 negotiated is not configured in profile /Common/MyClientSSLProfile. Nov 7 08:21:44 bigip7 err tmm3[12863]: 01260014:3: Cipher 16:2 negotiated is not configured in profile /Common/MyServerSSLProfile. Both of the above SSL Profiles utilize the "DEFAULT" cipher list. So, my assumption is that some clients are hitting this Virtual Server and are presenting a cipher that the DEFAULT cipher list doesn't include. Can anyone decode what the "Cipher 16:2" (there are others... "Cipher 4:3", "Cipher 16:3", "Cipher 4:2" etc.) notation means - is it specific to the lines you see when you issue "tmm -clientciphers 'DEFAULT'" or "tmm -serverciphers 'DEFAULT'"? I'm not sure that anything is really wrong here, but I am concerned that we might be trashing some SSL connections (doing a tcpdump of the traffic, and correlating times when the above /var/log/ltm errors get logged, then looking up the source IP address and correlating the timestamp to the Apache logfiles shows me most of these hits are to the webserver and doing a "GET /") - clearly not all SSL transactions are throwing the /var/log/ltm errors - just some. Thanks for any insight anyone may have. JoeSolved616Views0likes7Comments01070312:3: Invalid keyword 'ecdhe-ecdsaaes256- gcm-sha384' in ciphers list for profile
Hi Guys! Does anyone experience the same issue? We are experiencing SSL/TLS Vulnerabilities per our Security Team we need to apply the certain cipher configuration and it includes this string SHA384:ECDHE-ECDSAAES256- GCM-SHA384 however our F5 doesn't accept it. 01070312:3: Invalid keyword 'ecdhe-ecdsaaes256- gcm-sha384' in ciphers list for profile /Common/xxxxxx Thank you!442Views0likes3Comments