Zilog EZ80F91AZA Manual do Utilizador descarregar pdf (Página 41)

UM020107-1211 SSL Configuration

ZTP Network Security SSL Plug-In

User Manual

The first entry in every cipher suite table must indicate a NULL cipher suite; i.e., one that

uses the NULL PKI algorithm, the NULL cipher algorithm and the NULL digest algo-

rithm. This cipher suite must never be enabled (i.e.,

IsValid is set to FALSE). It is

included in the cipher suite because it describes the session’s initial state (operation on a

completely unsecured channel).

The ordering of cipher suites within each table is significant. Entries appearing higher in

the table are preferred over entries appearing lower in the table. For example, in the sam-

ple cipher suite table above, it is possible that both the client and server support both

cipher suites; however, because the

TLS_RSA_WITH_RC4_128_MD5 entry appears before

TLS_RSA_WITH_DES_CBC_SHA, preference will be given to the

TLS_RSA_WITH_RC4_128_MD5 cipher suite. When the corresponding ZTP Network

Security SSL Plug-In SSL handshake protocol is operating as a server, it selects the first

matching entry in the cipher suite table that matches the list of cipher suites supplied by

the client. When the corresponding SSL protocol is operating in client mode, it orders its

list of supported cipher suites in the same order as they appear in the cipher suite table,

thus indicating the order of preference to the server. In either situation, all cipher suites in

the table for which the

IsValid flag is FALSE are ignored.

Synchronizing PKI, Cipher and Digest Configurations

After the cipher suite tables are created, it is easy to determine the minimal set of PKI

algorithms, cipher algorithms and digest algorithms that must be configured in the

Pki-

Gen

, CipherGen, and HashGen arrays. For example, to determine what entries must exist

in the

CipherGen array to support all cipher suites for which the IsValid flag is set to

TRUE, note each unique entry in the

CipherAlg field. Suppose the cipher suites all used

SSL_CIPHER_NULL, SSL_CIPHER_RC4 or SSL_CIPHER_DES. As a result, the Cipher-

Gen

array could be modified, as shown in the following code fragment, because the 3DES

and AES cipher algorithms will not be required.

CIPHER_NEW CipherGen[ SSL_MAX_CIPHERS ] =

{

NullCipher_New,

RC4_New,

DES_New,

NullCipher_New, // 3DES not required

NullCipher_New // AES not required

};

Configuring the HashGen array is slightly more complicated, because the HMAC_MD5 and

HMAC_SHA1 hashes are always used by TLSv1 – even though they never appear in the

Note:

1 2 ... 36 37 38 39 40 41 42 43 44 45 46 ... 78 79

Comentários a estes Manuais

Sem comentários

Zilog EZ80F91AZA Manual do Utilizador Página 41

Comentários a estes Manuais

Manuais e produtos relacionados com Sensores Zilog EZ80F91AZA