Protocols and ciphers

Edit online

Use the supported protocols and ciphers in IBM® Verify Directory, for secure communications.

The following protocols are supported for secure communications in a server and client environment:

  • TLS 1.3
  • TLS 1.2
  • TLS 1.1
  • TLS 1.0
  • SSLv3

The following ciphers are supported for secure communications in a server and client environment:

Table 1. Supported TLS 1.3 ciphers by server, FIPS-approved TLS 1.3 ciphers, and default TLS 1.3 ciphers supported by client utilities

This table lists the supported TLS 1.3 ciphers by server, FIPS-approved TLS 1.3 ciphers, and default TLS 1.3 ciphers that are supported by client utilities for the TLS 1.3 protocol in IBM Verify Directory.
Supported TLS 1.3 ciphers by server FIPS-approved TLS 1.3 ciphers Default TLS 1.3 ciphers that are supported by client utilities
TLS_AES_128_GCM_SHA256 Yes Yes
TLS_AES_256_GCM_SHA384 Yes Yes
TLS_AES_128_CCM_SHA256 Yes Yes
TLS_AES_128_CCM_8_SHA256 Yes Yes
TLS_CHACHA20_POLY1305_SHA256 No No
Table 2. Supported TLS 1.2 ciphers by server, FIPS-approved TLS 1.2 ciphers, and default TLS 1.2 ciphers supported by client utilities

This table lists the supported TLS 1.2 ciphers by server, FIPS-approved TLS 1.2 ciphers, and default TLS 1.2 ciphers that are supported by client utilities for the TLS 1.2 protocol in IBM Verify Directory.
Supported TLS 1.2 ciphers by server FIPS-approved TLS 1.2 ciphers Default TLS 1.2 ciphers that are supported by client utilities
TLS_RSA_WITH_RC4_128_SHA No No
TLS_RSA_WITH_3DES_EDE_CBC_SHA Yes Yes
TLS_RSA_WITH_AES_128_CBC_SHA Yes Yes
TLS_RSA_WITH_AES_256_CBC_SHA Yes Yes
TLS_RSA_WITH_AES_128_GCM_SHA256 Yes Yes
TLS_RSA_WITH_AES_256_GCM_SHA384 Yes Yes
TLS_RSA_WITH_AES_128_CBC_SHA256 Yes Yes
TLS_RSA_WITH_AES_256_CBC_SHA256 Yes Yes
TLS_ECDHE_RSA_WITH_RC4_128_SHA No No
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA Yes No
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA Yes No
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA Yes No
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 Yes Yes
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 Yes Yes
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 Yes Yes
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 Yes Yes
TLS_ECDHE_ECDSA_WITH_RC4_128_SHA No No
TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA Yes No
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA Yes Yes
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA Yes Yes
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 Yes Yes
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 Yes Yes
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 Yes Yes
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 Yes Yes
TLS_DHE_PSK_WITH_AES_128_CCM Yes No
TLS_DHE_PSK_WITH_AES_128_CCM_8 Yes No
TLS_DHE_PSK_WITH_AES_256_CCM Yes No
TLS_DHE_PSK_WITH_AES_256_CCM_8 Yes No
TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 No No
TLS_DHE_RSA_WITH_AES_128_CCM Yes No
TLS_DHE_RSA_WITH_AES_128_CCM_8 Yes No
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 Yes No
TLS_DHE_RSA_WITH_AES_256_CCM Yes No
TLS_DHE_RSA_WITH_AES_256_CCM_8 Yes No
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 Yes No
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 No No
TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 Yes No
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 No No
TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 No No
TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256 No No
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 No No
TLS_PSK_WITH_AES_128_CCM Yes No
TLS_PSK_WITH_AES_128_CCM_8 Yes No
TLS_PSK_WITH_AES_256_CCM Yes No
TLS_PSK_WITH_AES_256_CCM_8 Yes No
TLS_RSA_WITH_AES_128_CCM Yes No
TLS_RSA_WITH_AES_128_CCM_8 Yes No
TLS_RSA_WITH_AES_256_CCM Yes No
TLS_RSA_WITH_AES_256_CCM_8 Yes No
Table 3. Supported ciphers for the SSLv3, TLS 1.0, and TLS 1.1 protocols and FIPS-approved ciphers for the TLS 1.0 and TLS 1.1 protocols

This table lists the supported ciphers for the SSLv3, TLS 1.0, and TLS 1.1 protocols and FIPS-approved ciphers for the TLS 1.0 and TLS 1.1 protocols in IBM Verify Directory, and hex values of ciphers.
Ciphers in the ibmslapd.conf file Hex value Supported by SSLv3 and TLS 1.0 protocols Supported by TLS 1.1 protocol FIPS-approved ciphers for TLS 1.0 and TLS 1.1 protocols
RC4-40-MD5 03 Yes No No
RC4-128-MD5 04 Yes Yes No
RC4-128-SHA 05 Yes Yes No
RC2-40-MD5 06 Yes No No
DES-56 09 Yes Yes No
TripleDES-168 0A Yes Yes Yes
AES-128 2F Yes Yes Yes
AES 35 Yes Yes Yes