Implementing TLS Security in a PowerExchange Network

Back Next

FIPS 140-2 Compliant Cipher Suites

During a TLS handshake, the client and server agree on a symmetric algorithm to use to encrypt data during the session. The client offers a list of cipher suites, and the server selects one from the list. For the PowerExchange network to be FIPS 140-2 compliant, the selected cipher suite must be FIPS 140-2 compliant.

On Linux, UNIX, or Windows clients or servers, PowerExchange uses the OpenSSL runtime engine. When a client and server are both using OpenSSL, the cipher suite that PowerExchange selects is FIPS 140-2 compliant.

On z/OS, AT-TLS manages TLS sessions. The order of cipher suites in the TTLSCipherParms statement in the AT-TLS policy file is important. The server selects the first cipher suite in the list that matches one offered by the client. In this process, ciphers are identified with hexadecimal cipher suite numbers.

To ensure that a z/OS server selects a FIPS 140-2 compliant cipher suite, verify that the first cipher suite in the TTLSCipherParms list matches one of the FIPS 140-2 compliant cipher suites that OpenSSL supports.

The following table is a partial list of FIPS 140-2 compliant cipher suites that OpenSSL and AT-TLS both support:

OpenSSL Cipher Suite Name	AT-TLS Cipher Suite Name	Hexadecimal Value
DHE-RSA-AES256-SHA	TLS_DHE_RSA_WITH_AES_256_CBC_SHA	39
DHE-DSS-AES256-SHA	TLS_DHE_DSS_WITH_AES_256_CBC_SHA	38
AES256-SHA	TLS_RSA_WITH_AES_256_CBC_SHA	35
EDH-RSA-DES-CBC3-SHA	TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA	16
EDH-DSS-DES-CBC3-SHA	TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA	13
DES-CBC3-SHA	TLS_RSA_WITH_3DES_EDE_CBC_SHA	0A
DHE-RSA-AES128-SHA	TLS_DHE_RSA_WITH_AES_128_CBC_SHA	33
DHE-DSS-AES128-SHA	TLS_DHE_DSS_WITH_AES_128_CBC_SHA	32
AES128-SHA	TLS_RSA_WITH_AES_128_CBC_SHA	2F

For a complete list of algorithms that OpenSSL and AT-TLS support, see the OpenSSL and AT-TLS documentation.

The optional, no-charge CPACF feature, which is available on IBM System z machines, provides machine instructions to accelerate hashing algorithms and symmetric key encryption and decryption used with TLS. For performance reasons, you might want to use only those cryptographic suites for which hardware assists are available. For example, CPACF supports AES-128 on z9 and later machines and supports AES-256 on z10 and z196 machines.

Rename Saved Search

Table of Contents

Implementing TLS Security in a PowerExchange Network

Implementing TLS Security in a PowerExchange Network

FIPS 140-2 Compliant Cipher Suites

FIPS 140-2 Compliant Cipher Suites