RFR: 8279164: Disable TLS_ECDH_* cipher suites

Bernd duke at openjdk.org
Thu Nov 3 15:28:46 UTC 2022


On Thu, 3 Nov 2022 14:59:59 GMT, Sean Mullan <mullan at openjdk.org> wrote:

> This change will disable TLS_ECDH_* cipher suites by default. These cipher suites do not preserve forward secrecy and are rarely used in practice. See the CSR for more details and rationale.
> 
> Users will still be able to enable the suites (at their own risk) by removing "ECDH" from the `jdk.tls.disabledAlgorithms` security property.

Should probably also be mentioned as planned on the Ora crypto roadmap or will it only be added at release time?

-------------

PR: https://git.openjdk.org/jdk/pull/10969


More information about the security-dev mailing list