Shibboleth Developers

[Ian Young <>]

I just ran down a problem which turned out to be related to choice of
OpenSSL cipher suites in a particular circumstance.  This reminded me
that I've had understanding cipher suites on my to-do list for some
time.  So, I went back and looked at the Apache SSL configuration
examples on the Shibboleth wiki.

These look like this:

SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP

I'm curious as to where this recommendation came from, as it differs in
only one respect from the default setting:

SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP

The difference (!EXPORT56) excludes some weak "exportable" ciphers with
56-bit key sizes.  I can see why one might want to do that, but not why
one would want to do that but *not* exclude the even weaker "exportable"
ciphers with 40-bit key sizes.

I also have to say I'm a bit dubious about SSLv2 in general, but that's
a separate question.

Anyone remember what is going on here?

        -- Ian