Detections
Analytics

8.1.6 Configure Secure TLS Cipher Suites (SSL_CIPHERSPECS)

Information

The SSL_CIPHERSPECS database manager configuration parameter controls which cipher suites are enabled by Db2. If it is unset, Db2 will enable a default list of ciphers.

Some cipher suites have known issues or do not enable perfect forward secrecy. Specifically the TLS_RSA_WITH_* cipher have known weaknesses and do not support perfect forward secrecy and should not be enabled.

All of the TLS 1.3 ciphers suites are considered secure, it is only some of those for TLS 1.2 that are of concern.

Solution

Perform the following to set SSL_CIPHERSPECS :

 -

Attach to the Db2 instance.

db2 => attach to <db2instance>
 -

Run the following command to enable a specific set of ciphers withinthe Db2 server.

db2 => update dbm cfg using SSL_CIPHERSPECS <LIST>

Replace <LIST> with one or multiple of the following cipher suites. If multiple items are specified, separate them with a single comma and no spaces.

 - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
 - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
 - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
 - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
 - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
 - TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
 - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
 - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256

The choice of which values to use will depend on the type of certificate that the server is using. Even if TLS 1.3 is in use, it is acceptable not to specify any TLS 1.3 cipher suites in SSL_CIPHERSPECS, as the default list for TLS 1.3, all of which are secure, will be used.

See Also

https://workbench.cisecurity.org/benchmarks/23492

Item Details

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-17(2), 800-53|IA-5, 800-53|IA-5(1), 800-53|SC-8, 800-53|SC-8(1), CSCv7|14.4

Plugin: IBM_DB2DB

Control ID: f2bd49cad2f01bf41b2ecd88500f98b72e417e85a07b0bbf6ebfe8fb0c3fca0b