eclipse-vertx / eclipse-vertx/vert.x

Support filtering of insecure CipherSuits when using TLS

Open
#4,133 2 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
14.7k
Forks
2.1k
Avg merge
2d 7h
Merged PRs (30d)
28

Description

In order to remove insecure cipher suits from secure TLS versions.

e.g. TLS 1.2 is required [rfc5246](https://datatracker.ietf.org/doc/html/rfc5246#appendix-A.5) to support TLS_RSA_WITH_AES_128_CBC_SHA however and other are vulnirable to the [Lucky13](http://www.isg.rhul.ac.uk/tls/Lucky13.html) attack and should be removed by the user.

Netty the underlying transport for VertX supports this via [io.netty.handler.ssl.CipherSuiteFilter](https://github.com/netty/netty/blob/07cc3fd57993ac3d7b18375e1bd453dfbdb2b27d/handler/src/main/java/io/netty/handler/ssl/CipherSuiteFilter.java)

This needs to be exposed to VertX so insecure ciphers can be removed.

This was discussed in #1507 but a solution was not proposed.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.