PH71273: THE SAMPLE SCRIPTS FOR AT-TLS CONTAIN OUTDATED GUIDANCE FOR CIPHER SUITES AND KEY USAGE

APAR status

• Closed as duplicate of another APAR.

Error description

• The sample scripts for AT-TLS contain outdated guidance for
  cipher suites and key usage
  

Local fix

Problem summary

• The AT-TLS sample scripts contain outdated guidance for AT-TLS
  configuration. Two of the cipher suites
  (TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 and
  TLS_DHE_RSA_WITH_AES_128_GCM_SHA256) are now considered to be
  weak. Two cipher suites that are needed for TLS 1.2 with the
  NISTECC key algorithm (TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
  and TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256) are missing. The
  key usage includes a usage (DATAENCRYPT) that is no longer
  needed with the recommended cipher suites. There was no guidance
  for the key algorithm or key size.
  

Problem conclusion

• The CECRDTL1 sample JCL script was updated to change the key
  usage to HANDSHAKE and to add a key algorithm (NISTECC) and key
  size (256).
  
  The CECRDTLP sample AT-TLS profile script was updated to add the
  TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 and
  TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 cipher suites and to
  remove the TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 and
  TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 cipher suites
  

Temporary fix

Comments

• This Apar has been shipped at part of PTF UO07993 (APAR
  PH71187).
  

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels