Oracle Database Advanced Security 10g Release 1, Руководство администратора

Страница: 194 / 518

Enabling SSL
7-28 Oracle Database Advanced Security Administrator's Guide
Step 4: Set the Client SSL Cipher Suites (Optional)
A cipher suite is a set of authentication, encryption, and data integrity algorithms
used for exchanging messages between network entities. During an SSL handshake,
two entities negotiate to see which cipher suite they will use when transmitting
messages back and forth.
When you install Oracle Advanced Security,the SSL cipher suites listed in Table 7–1
are set for you by default. This table lists them in the order they are tried when two
entities are negotiating a connection. You can override the default by setting the
SSL_CIPHER_SUITES
parameter. For example, if you use Oracle Net Manager to
add the cipher suite
SSL_RSA_WITH_RC4_128_SHA
, all other cipher suites in the
default setting are ignored.
You can prioritize the cipher suites. When the client negotiates with servers
regarding which cipher suite to use, it follows the prioritization you set. When you
prioritize the cipher suites, consider the following:
■
The level of security you want to use. For example, triple-DES encryption is
stronger than DES.
■
The impact on performance. For example, triple-DES encryption is slower than
DES. See
"Configuring Your System to Use Hardware Security Modules" on
page 7-48 for information about using SSL hardware accelerators with Oracle
Advanced Security.
■
Administrative requirements:
The cipher suites selected for a client must be compatible with those required
by the server. For example, in the case of an Oracle Call Interface (OCI) user, the
server requires the client to authenticate itself. You cannot, in this case, use a
cipher suite employing Diffie-Hellman anonymous authentication which
disallows the exchange of certificates.
You typically prioritize cipher suites starting with the strongest and moving to the
weakest.
Table 7–1 lists the SSL cipher suites supported in the current release of Oracle
Advanced Security. These cipher suites are set by default when you install Oracle
Advanced Security. This table also lists the authentication, encryption, and data
integrity types each cipher suite uses.