How to Deny the Diffie-Hellman Key Exchange

[ntl75]

I would like to deny this because they are considered weak ciphers because of the DHE component.

Any step by step guide on this

thanks again in advance

[kita]

Are we looking to remove DHE completely or just 1024-bit and lower?

[ntl75]

Hi we would like to remove DHE altogether (WOULD THIS BE AN ISSUE?) and use the following:

TLS_RSA_WITH_AES_256_CBC_SHA256
TLS_RSA_WITH_AES_256_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_AES_128_CBC_SHA256
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_AES_256_GCM_SHA384
TLS_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

thanks

[kita]

Hello NTL75,

Currently, there are no known vulnerabilities with ECDHE cipher suites. We plan to add a feature to allow customer's to select cipher suites they would like to support in 8.2RX. This is planned for the later part of Q4 2015.

[ntl75]

Hi, Many thanks for your reply.
So at present there is no way for me to achieve what I had planned?

thanks

[psirt]

Hi ntl75,

A new feature to disable 1024 bit DH key exchange will be added in new releases of code. Please see the "Logjam" section on the following security advisory for more information: https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40002

Thanks,
Pulse Secure PSIRT

[kita]

Correct. There is no current way to specifically disable all ECDHE and DHE cipher suites. However, due to the recent concerns with 1024-bit DHE cipher suites and below, we will be making a change to disable 1024-bit DHE cipher in the next releases.