AT-TLS currency with System SSL

z/OS® V2R3 Communications Server enhances Application Transparent TLS (AT-TLS) to support the features provided by System SSL.

  • Support for NIST SP800-131A (key length transition recommendations). Add support for higher security strengths (larger key sizes) as defined in NIST SP800-131A, which allows a more secure FIPS 140-2 implementation.
    • New FIPS mode “levels” indicate the minimum key sizes, allowing for the enforcement of larger key sizes.
  • Support for NIST SP800-52A Revision 1 (TLS implementation guidelines) which adds new certificate processing controls.
    • Prevent the use of triple DES keys that do not consist of 3 unique values when not in FIPS mode.
    • Configure a server with multiple X.509 certificates and the associated private keys to support TLS handshakes with peers having certificates with differing key types.
    • Configure a client or server to enforce that only Version 3 or higher X.509 certificate be accepted for a received peer end-entity certificate.
    • Configure a client to enforce a minimum ephemeral Diffie-Hellman group size from the server.
    • Configure a server to use a minimum ephemeral Diffie-Hellman group size.
    • Configure a server to create ephemeral Diffie-Hellman groups on the fly and not use pre-defined groups.
    • Configure a client or server with a minimum key size for DH, DSA, ECC, or RSA keys.
  • Support for several RFCs governing OCSP (RFC 6066, RFC 6277, RFC 6960 and RFC 6961), specifically:
    • Control over signatures of OCSP messages (RFC 6277 and 6960)
      • Specify the hash and signature algorithms that will be accepted from OCSP responders.
      • Support for inclusion of the OCSP response for the server's certificate as a TLS extension during the TLS handshake.
    • Greater efficiency in the OCSP protocol (RFCs 6066 and 6961)
  • Support for RFCs regarding Suite B Profile clarifications (RFCs 6460 and 5759)
    • Support for new 128Min and 192Min profiles. The 128Min profile states that only AES-GCM ciphers that comply with the 128-bit minimum Suite B profile can be used for a TLS session. The 192Min profile states that only AES-GCM ciphers that comply with the 192-bit minimum Suite B profile can be used for a TLS session.
    • When 128Min or 192Min is enabled, the certificates and CRLs will automatically be validated according to the specifications outlined in RFC 5759.
  • Support for Signaling Cipher Suite Values (SCSV) to protect against protocol downgrade attacks (RFC 7507). The Signaling Cipher Suite Value (SCSV) is sent by the TLS/SSL client in the CLIENT-HELLO message to indicate that this connection is a fallback attempt to an earlier protocol version.
    • Configure server to honor SCSV when included in the client's cipher list

AT-TLS currency with System SSL

To use the AT-TLS currency with System SSL , perform the appropriate tasks in Table 1.
Table 1. AT-TLS currency with System SSL
Task/Procedure Reference

Enable the new AT-TLS support by using the IBM® Configuration Assistant for z/OS Communications Server or manual configuration.

Optionally, display the new policy-based networking parameters and values. Use the pasearch command to display AT-TLS policies.

 The z/OS UNIX pasearch command: Display policies in z/OS Communications Server: IP System Administrator's Commands

Display AT-TLS information by using the Netstat command.

Netstat TTLS/-x report in z/OS Communications Server: IP System Administrator's Commands
To find all related topics about AT-TLS currency with System SSL, see Table 2.
Table 2. All related topics about AT-TLS currency with System SSL
Book name Topics
z/OS Communications Server: IP Configuration Guide FIPS 140-2 support
z/OS Communications Server: IP Configuration Reference
z/OS Communications Server: IP Programmer's Guide and Reference
z/OS Communications Server: IP System Administrator's Commands Netstat TTLS/-x report
z/OS Communications Server: IP Sockets Application Programming Interface Guide and Reference IOCTL