Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

In the postgresql.conf file, one can configure authorized values for ssl_cipher. Yet I could not find documentation explaining what the ALL, ADH, LOW, EXP, MD5 and STRENGTH values correspond to.

MD5 refers to the corresponding MD5 algorithm I guess, but what about the other values? I believe LOW should not be used in a production environment.

share|improve this question

1 Answer 1

up vote 3 down vote accepted

This is a parameter that is processed by the OpenSSL library. The format and options are documented in the ciphers(5) man page.

For the ones you mention:

ALL

all cipher suites except the eNULL ciphers which must be explicitly enabled; as of OpenSSL, the ALL cipher suites are reasonably ordered by default

ADH

anonymous DH cipher suites, note that this does not include anonymous Elliptic Curve DH (ECDH) cipher suites.

LOW

``low'' encryption cipher suites, currently those using 64 or 56 bit encryption algorithms but excluding export cipher suites.

EXP, EXPORT

export encryption algorithms. Including 40 and 56 bits algorithms.

MD5

cipher suites using MD5.

You can combine them and specifically include or exclude classes of ciphers by using prefixes:

Each cipher string can be optionally preceded by the characters !, - or +.

If ! is used then the ciphers are permanently deleted from the list. The ciphers deleted can never reappear in the list even if they are explicitly stated.

If - is used then the ciphers are deleted from the list, but some or all of the ciphers can be added again by later options.

If + is used then the ciphers are moved to the end of the list. This option doesn't add any new ciphers it just moves matching existing ones.

@STRENGTH is a bit special:

The cipher string @STRENGTH can be used at any point to sort the current cipher list in order of encryption algorithm key length.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.