SSL Cipher Suites

SSL cipher suites can be used with SOAP, RADIUS, and SEAL communicator modules. OneSpan Authentication Server Appliance supports SSL cipher suites defined under the security level labels Very High, High, Medium, and Low.

SEAL, SOAP and RADIUS/EAP will accept TLSv1 (and later) connections.

The security levels are applied to the following communication protocols:

• SOAP
• SEAL
• RADIUS (RADIUS / EAP-TTLS and RADIUS / PEAP only)

Configuring security levels for SSL cipher suites

You can configure the SSL cipher suite security level for communicator modules that are enabled with SSL/TLS.

To configure the SSL cipher suite security level

1. In the Configuration Tool, select Authentication Server and select the communicator module: SEAL Communicator, SOAP Communicator, or RADIUS Communicator.
2. Specify the SSL cipher suite security level.
3. Click Save.

Blocked cipher suites

The OneSpan Authentication Server communication interfaces, when configured to use SSL/TLS, will actively block certain cipher suites. All OneSpan Authentication Server components actively block the suites to which the criteria listed below apply. This also includes custom cipher suites, i.e. if the criteria also apply to custom-defined cipher suites, the OneSpan Authentication Server components will also actively block these suites.

Criteria for cipher suites to be blocked:

• All cipher suites which do not offer encryption
• All cipher suites which do not offer authentication
• All export encryption algorithms
• Cipher suites defined by OpenSSL as low encryption
• All cipher suites which use MD5 as hashing algorithm
• All cipher suites that use pre-shared keys

Cipher suites in OneSpan Authentication Server Administration Web Interface

The following cipher suites are accepted by the OneSpan Authentication Server Administration Web Interface: