HPE FlexNetwork HSR6800 series, Security Command Reference

Page: 367 / 538

354
prefer-ctos-cipher : Specifies the preferred client-to-server encryption algorithm. The default is
aes128 .
•
3des : Specifies the encryption algorithm 3des-cbc. This keyword is not available in FIPS mode.
•
aes128 : Specifies the encryption algorithm aes128-cbc.
•
aes256 : Specifies the encryption algorithm aes256-cbc. This keyword is not available in
non-FIPS mode.
•
des : Specifies the encryption algorithm des-cbc.
prefer-ctos-hmac : Specifies the preferred client-to-server HMAC algorithm. The default is sha1-96 .
•
md5 : Specifies the HMAC algorithm hmac-md5. This keyword is not available in FIPS mode.
•
md5-96 : HMAC algorithm hmac-md5-96. This keyword is not available in FIPS mode.
•
sha1 : Specifies the HMAC algorithm hmac-sha1.
•
sha1-96 : Specifies the HMAC algorithm hmac-sha1-96.
prefer-kex : Specifies the preferred key exchange algorithm. In non-FIPS mode, the default is
dh-group-exchange . In FIPS mode, the default is dh-group14 .
•
dh-group-exchange : Specifies the key exchange algorithm
diffie-hellman-group-exchange-sha1. This keyword is not available in FIPS mode.
•
dh-group1 : Specifies the key exchange algorithm diffie-hellman-group1-sha1. This keyword is
not available in FIPS mode.
•
dh-group14 : Specifies the key exchange algorithm diffie-hellman-group14-sha1.
prefer-stoc-cipher : Specifies the preferred server-to-client encryption algorithm. The default is
aes128 .
prefer-stoc-hmac : Specifies the preferred server-to-client HMAC algorithm. The default is sha1-96 .
Usage guidelines
When the server adopts publickey authentication to authenticate a client, the client must get the local
private key for digital signature. In non-FIPS mode, because the publickey authentication uses either
RSA or DSA algorithm, you must specify the public key algorithm of the client (by using the
identity-key keyword) in order to get the correct local private key.
In non-FIPS mode, the default algorithms are as follows:
•
The algorithm for publickey authentication is dsa .
•
The preferred client-to-server encryption algorithm is aes128 .
•
The preferred client-to-server HMAC algorithm is sha1-96 .
•
The preferred key exchange algorithm is dh-group-exchange .
•
The preferred server-to-client encryption algorithm is aes128 .
•
The preferred server-to-client HMAC algorithm is sha1-96 .
In FIPS mode, the default algorithms are as follows:
•
The algorithm for publickey authentication is rsa .
•
The preferred client-to-server encryption algorithm is aes128 .
•
The preferred client-to-server HMAC algorithm is sha1-96 .
•
The preferred key exchange algorithm is dh-group14 .
•
The preferred server-to-client encryption algorithm is aes128 .
•
The preferred server-to-client HMAC algorithm is sha1-96 .
Examples
# Connect to server 2:5::8:9, using the following connection scheme:
•
The preferred key exchange algorithm is dh-group1 .