IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Quality
of
protection
levels
You
can
control
the
default
level
of
encryption
required
for
access
to
WebSEAL
over
SSL
(HTTPS)
by
configuring
the
quality
of
protection
(QOP).
Default
quality
of
protection
management
is
controlled
using
parameters
in
the
″SSL
QUALITY
OF
PROTECTION
MANAGEMENT″
section
of
the
WebSEAL
configuration
file:
v
Enable
and
disable
QOP
management
with
the
ssl-qop-mgmt
parameter
v
Specify
allowed
encryption
levels
in
the
[ssl-qop-mgmt-default]
stanza
1.
Enable
quality
of
protection
management:
[ssl-qop]
ssl-qop-mgmt
=
yes
2.
Specify
the
default
encryption
level
for
HTTPS
access.
The
syntax
is:
default
=
{ALL|NONE|cipher_level}
Supported
values
for
cipher_level
are:
NONE,
ALL,
NULL,
DES-56,
FIPS-DES-56,
DES-168,
FIPS-DES-168,
RC2-40,
RC2-128,
RC4-40,
RC4-56,
RC4-128,
AES-128,
AES-256
NONE
disable
For
example:
[ssl-qop-mgmt-default]
default
=
ALL
Note
that
you
can
also
specify
a
selected
group
of
ciphers:
[ssl-qop-mgmt-default]
default
=
RC4-128
default
=
RC2-128
default
=
DES-168
Notes:
v
NONE
means
that
no
SSL
connection
allowed.
v
NULL
means
that
unencrypted
SSL
connection
allowed.
v
ALL
means
that
all
types
of
SSL
connections
allowed.
v
There
can
be
multiple
cipher/MAC
made
available
to
the
connection
for
a
given
qop
cipher
selection.
These
will
still
have
the
same
encryption
bit
strength,
just
different
MAC
methods
(SHA1
or
MD5)
v
RC2-128
is
only
available
with
SSLv2.
If
it
is
the
only
cipher
selection,
WebSEAL
will
disable
SSLv3
and
TLSv1
for
the
affected
connection.
v
NULL,
FIPS-DES-56,
FIPS-DES-168,
RC4-56,
AES-128,
and
AES-256
are
only
available
with
SSLv3
and
TLSv1.
If
they
are
the
only
ciphers
available
to
a
given
connection,
SSLv2
will
be
disabled
for
the
affected
connection.
v
AES
Support
is
determined
automatically
by
GSKit
based
on
the
base-crypto-library
setting.
AES-128
and
AES-256
are
only
available
if
AES
Support
is
enabled
by
GSKit,
else
they
will
be
ignored.
v
FIPS-DES-56
and
FIPS-DES-168
are
only
available
when
fips-mode-
processing
is
enabled
(set
to
yes).
Otherwise
they
are
ignored
Tivoli
Access
Manager
uses
GSKit
7.
The
Cipher
specifications
supported
by
GSKIT7
when
used
in
SSLv2/TLS
in
internet
security
are:
SSL_RSA_WITH_NULL_MD5
SSL_RSA_WITH_NULL_SHA
38
IBM
Tivoli
Access
Manager
for
e-business:
WebSEAL
Administration
Guide