0

I am trying to enable and enforce RC4 cipher on Apache 2.4 and I checked the http://httpd.apache.org/docs/trunk/ssl/ssl_howto.html It says RC4 cipher can be enabled in one of the below two ways:

1. SSLCipherSuite RC4-SHA:AES128-SHA:HIGH:!aNULL:!MD5 
   SSLHonorCipherOrder on

2. SSLCipherSuite ALL:!aNULL:RC4+RSA:+HIGH:+MEDIUM:+LOW:+EXP:+eNULL 

Which one is the better to enable and enforce RC4 cipher?

How do I test the enabled ciphers with openSSL?

1
  • No one of those will enforce RC4. The second activates all, the first activates all highs.
    – sebix
    Jun 23, 2015 at 19:04

1 Answer 1

1

You want to... enable RC4? Is this for some sort of honeypot or something? You really don't want to use it in normal use, because RC4 is broken.

If you really want to, though, I think the way to enforce the use of RC4 would be just to make the cipher spec RC4 by itself -- that'll enable all cipher combinations that include the use of RC4. You may want to then disable some of the even-more-broken ciphers, like NULL and export-grade ciphers, as well as deprecated unnecessary ones like MD5, with something like RC4:!MD5:!aNULL:!EXPORT.

And may $DEITY have mercy on your soul...

2
  • MD5 for HMAC isn't broken last I heard, although SHA (meaning SHA1) is better; !EXPORT and !aNULL prevent dangers that would be worse, although good clients won't offer them anyway. Aug 19, 2015 at 10:00
  • @dave_thompson_085 good catch on export/NULL; I've added them to my answer. As for HMAC-MD5, RFC6151 says "it isn't quite broken yes, but don't use it for anything new". Since I don't know of any reasonably popular SSL client implementation that only supports MD5, it seems prudent to get ahead of the curve and just turn 'em off now.
    – womble
    Aug 19, 2015 at 21:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .