RE: SSL Cipher Support and V7R1... and so it begins

Paul,

Read Brad's post a couple of times.
Basically if you're using some of his software (like GETURI) or even a
"roll your own" solution to do the same thing,
and you're talking to a financial institution,
they may no longer allow you to connect to their institution.
Now is the time when they are cracking down on this.

I think SHA256 is one of the ones that many institutions are dropping.

IDK if any of the places you are connecting to have a web link which
states something like "as of yyyy-mm-dd we will no longer accept
connections using SHA256". I've also found that some places make browsing
a little difficult. Here is an old audit report we got dinged on that
we've since cleared up. I had to manually type it since it used images.

xxx.xx.xxx.xx:443 Negotiated with the following insecure cipher suites:
SSL 3.0 ciphers
TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_AES_128_CBC_SHATLS_RSA_WITH_AES_256_CBC_SHA
TLS_DHE_RSA_WITH_AES_256_CBC_SHA

Many institutions are tight lipped about this stuff and only alert you via
memos to people who don't understand this (like your accounting people)
and ignore it. They may fear that posting this on their website simply
says "Yo dudes, we're still using these pathetic encryptions and if you
want to hack us you'd better do it before then".
Not dinging accounting people. They're pretty busy.


Rob Berendt