|
1842
|
1 % Cipher policy enforcement with application level error reporting |
|
|
2 |
|
|
3 # Introduction |
|
|
4 |
|
|
5 This module arose from discussions at the XMPP Summit about enforcing |
|
|
6 better ciphers in TLS. It may seem attractive to disallow some |
|
|
7 insecure ciphers or require forward secrecy, but doing this at the TLS |
|
|
8 level would the user with an unhelpful "Encryption failed" message. |
|
|
9 This module does this enforcing at the application level, allowing |
|
|
10 better error messages. |
|
|
11 |
|
|
12 # Configuration |
|
|
13 |
|
|
14 First, download and add the module to `module_enabled`. Then you can |
|
|
15 decide on what policy you want to have. |
|
|
16 |
|
|
17 Requiring ciphers with forward secrecy is the most simple to set up. |
|
|
18 |
|
|
19 ``` lua |
|
|
20 tls_policy = "FS" -- allow only ciphers that enable forward secrecy |
|
|
21 ``` |
|
|
22 |
|
|
23 A more complicated example: |
|
|
24 |
|
|
25 ``` lua |
|
|
26 tls_policy = { |
|
|
27 c2s = { |
|
|
28 encryption = "AES"; -- Require AES (or AESGCM) encryption |
|
|
29 protocol = "TLSv1.2"; -- and TLSv1.2 |
|
|
30 bits = 128; -- and at least 128 bits (FIXME: remember what this meant) |
|
|
31 } |
|
|
32 s2s = { |
|
|
33 cipher = "AESGCM"; -- Require AESGCM ciphers |
|
|
34 protocol = "TLSv1.[12]"; -- and TLSv1.1 or 1.2 |
|
|
35 authentication = "RSA"; -- with RSA authentication |
|
|
36 }; |
|
|
37 } |
|
|
38 ``` |
|
|
39 |
|
|
40 # Compatibility |
|
|
41 |
|
|
42 Requires LuaSec 0.5 |
|
|
43 |
