News
Abstract
System TLS enhancements to the TLSv1.3 and TLSv1.2 protocols for IBM i 7.4
Content
You are in: IBM i Technology Updates > IBM i Security > System TLS enhancements to the TLSv1.3 and TLSv1.2 protocols
The following enhancements can be obtained by applying multiple PTFs:
- Apply SI71547, SI72543, MF66742, MF67525 and all requisites.
- SF99662: 740 IBM HTTP Server for i PTF - Group Level: 3 or newer
- SF99665: 740 Java - PTF Group Level: 6 or newer
Elliptic curve Diffie-Hellman key exchange using Curve25519(x25519) and Curve448(x448)
The supported/enabled named elliptic curve groups list and the default named elliptic curve groups list have both been updated to include the x25519 and x448 named curves. Most applications will begin supporting these curves with no additional configration required.
The supported/enabled named elliptic curve groups list and the default named elliptic curve groups list have both been updated to include the x25519 and x448 named curves. Most applications will begin supporting these curves with no additional configration required.
The new ordered default list of groups is:
- Secp256r1
- Secp384r1
- x25519
- Secp521r1
- x448
Refer to Supported groups in the IBM i Knowledge Center for additional details.
TLSv1.2 ChaCha20 Poly1305 cipher suites
System TLS now includes support for the *ECDHE_ECDSA_CHACHA20_POLY1305_SHA256 and *ECDHE_RSA_CHACHA20_POLY1305_SHA256 cipher suites for the TLSv1.2 protocol.
System TLS now includes support for the *ECDHE_ECDSA_CHACHA20_POLY1305_SHA256 and *ECDHE_RSA_CHACHA20_POLY1305_SHA256 cipher suites for the TLSv1.2 protocol.
When system value QSSLCSLCTL is set to *OPSYS, both new cipher suites are included in the QSSLCSL system value. The new ordered list of *OPSYS cipher suites:
- *AES_128_GCM_SHA256
- *AES_256_GCM_SHA384
- *CHACHA20_POLY1305_SHA256
- *ECDHE_ECDSA_AES_128_GCM_SHA256
- *ECDHE_ECDSA_AES_256_GCM_SHA384
- *ECDHE_RSA_AES_128_GCM_SHA256
- *ECDHE_RSA_AES_256_GCM_SHA384
- *ECDHE_ECDSA_CHACHA20_POLY1305_SHA256
- *ECDHE_RSA_CHACHA20_POLY1305_SHA256
If QSSLCSLCTL is set to *USRDFN, then the new cipher suites can be manually added or removed from QSSLCSL.
Refer to Cipher suite configuration in the IBM i Knowledge Center for additional details.
Online Certificate Status Protocol (OCSP) stapling support
System TLS now includes support for OCSP stapling in the TLSv1.3 and TLSv1.2 protocols. This support allows client applications to send a certificate status request extension as part of the TLS handshake, as defined in RFC 6066, requesting that the server complete OCSP requests on behalf of the client. Based on the server's OCSP configuration, server applications enabling this new support query an OCSP responder and send the OCSP response back to the client.
System TLS now includes support for OCSP stapling in the TLSv1.3 and TLSv1.2 protocols. This support allows client applications to send a certificate status request extension as part of the TLS handshake, as defined in RFC 6066, requesting that the server complete OCSP requests on behalf of the client. Based on the server's OCSP configuration, server applications enabling this new support query an OCSP responder and send the OCSP response back to the client.
Refer to Online Certificate Status Protocol in the IBM i Knowledge Center for additional details.
RSASSA-PSS certificate type has been added to TLSv1.3
System TLS and Digital Certificate Manager (DCM) now support RSA certificates with RSASSA-PSS signatures by default for TLSv1.3. This support can be configured on the application definition in DCM, with GSKit APIs or with TLSCONFIG options defaultSignatureAlgorithmCertificateList and supportedSignatureAlgorithmCertificateList.
Refer to Certificate selection in the IBM i Knowledge Center for additional details.
Native IBM i JSSE provider support for TLSv1.3
The Java8 Native IBM i JSSE provider now supports TLSv1.3. TLSv1.3 support has been added to three existing Protocol values, "SSL", "SSL_TLS", and "SSL_TLSv2". The new protocol specific value of "TLSv1.3" was also added.
The Java8 Native IBM i JSSE provider now supports TLSv1.3. TLSv1.3 support has been added to three existing Protocol values, "SSL", "SSL_TLS", and "SSL_TLSv2". The new protocol specific value of "TLSv1.3" was also added.
Protocol values for the SSLContext.getInstance method
The following table identifies and describes the protocol values for the SSLContext.getInstance method of the native IBM i JSSE provider.
The following table identifies and describes the protocol values for the SSLContext.getInstance method of the native IBM i JSSE provider.
The supported TLS protocols may be limited by the system values set on your system. For more details, see the Security system values: Transport Layer Security protocols subtopic in the Systems management information.
| Protocol value | Supported TLS protocols |
|
SSL |
TLS version 1.3, 1.2, 1.1, 1.0 and SSL version 3. |
| SSLv3 | SSL version 3 protocol |
| TLSv1 | TLS version 1.0 protocol, defined in Request for Comments (RFC) 2246. |
| SSL_TLS | TLS version 1.3, 1.2, 1.1, 1.0 and SSL version 3. |
| TLSv1.1 | TLS version 1.1 protocol, defined in Request for Comments (RFC) 4346. |
| TLSv1.2 | TLS version 1.2 protocol, defined in Request for Comments (RFC) 5246. |
| TLSv1.3 | TLS version 1.3 protocol, defined in Request for Comments (RFC) 8446. |
| SSL_TLSv2 | TLS version 1.2, 1.1, 1.0 and SSL version 3. |
[{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SWG60","label":"IBM i"},"Component":"","Platform":[{"code":"PF012","label":"IBM i"}],"Version":"IBM i 7.4","Edition":"","Line of Business":{"code":"LOB57","label":"Power"}}]
Was this topic helpful?
Document Information
Modified date:
18 December 2023
UID
ibm11120257