up vote 2 down vote favorite
share [g+] share [fb]

If I am running Windows 7 and change the default ciphers on the PC, does this affect the connection between the client and server? If a similar change is only made on the server, does it affect the client? What if the changes are made on both the client and server?

link|improve this question
91% accept rate
feedback

1 Answer

up vote 1 down vote accepted

Yes. Client and server negotiate to pick which cipher will be used in an SSL/TLS session. So you could on your server or client and disable all the CBC ciphers and get rid of your exposure to BEAST. Most likely the best choices for ciphers are RC4 and 3DES though 3DES would be in CBC mode so not until MS fixes their implementation per discussions a few years ago. You should probably also check the root list on your client to make sure you don't by default trust every government and business in the world to manage your trust decisions for you.

link|improve this answer
I am unclear about your statement So you could on your server or client and disable all the CBC ciphers and get rid of your exposure to BEAST. Does this mean assuming no changes are made on the server i.e. the server still supports SSL 2 for example and I remove all the available ciphers on the client, I am still ridding myself to BEAST? – PeanutsMonkey Sep 28 '11 at 0:58
What would be considered a secure and default list of trusted root certificates? – PeanutsMonkey Sep 28 '11 at 0:59
It is the overlap between what the client and server are configured and capable of using that is selected from - if I remember correctly the ordering preference is given to the server. The implication being that if you [correctly] have SSL2 as well as some of the weaker ciphers disabled in your client then you will not establish a session with a servering using them. Since BEAST only works against CBC ciphers you can simply remove those from the negotiation by disabling them in the client or server. – Ram Sep 28 '11 at 4:01
1  
Who should you trust? A few hints about how to consider it is all I can offer. You want roots that are trustworthy, perhaps because they rely on their brand and have a history of few failures with strong recovery. You want roots that are backed by strong technical merit such as highly frequency OCSP and CRLs for every certificate in the chain and regular re-keying of intermediate certificates. – Ram Sep 28 '11 at 4:11
1  
Microsoft doesn't much care about your security and no one has had this discussion with their lawyers yet, I'm guessing. Maybe a kinder answer is Microsoft doesn't want to limit the people you choose to trust by default. – Ram Sep 28 '11 at 20:53
show 5 more comments
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.