You can manage SSL/TLS communication security, including the TLS version and cipher suites that are used in SSL/TLS communications between the management PC and the ESM.
For communications between the management PC and the ESM, the SSL/TLS communication security settings apply to communications that use the protocols and port numbers listed in the following table. If any of the following servers or remote storage system is used, the SSL/TLS communication security settings also apply to communications between that device and the ESM:
- Syslog server
- Key management server
- External authentication server or authentication server
- Storage system in the secondary site of remote copy
|
Protocol |
Port number |
|---|---|
|
HTTPS |
443 |
|
(VSP One B20 series) MPC Communication Protocol (SSL) |
10500 |
|
Notes: The SSL/TLS communication security settings are not applied to MPC Communication Protocol (Port: 10500) which is used for communication between the storage system and the MPC (used by maintenance personnel). |
|
You can configure the following settings in the Select TLS Security window of the Maintenance Utility.
- Security mode of SSL/TLS communication
-
Item
Description
Default value
FIPS
SSL/TLS communication security settings compliant with FIPS
Enabled (cannot be set to disabled)
CNSA1.0
SSL/TLS communication security settings compliant with CNSA1.0
Disabled
- Protocols and cipher suites that are permitted in SSL/TLS communications
-
If a protocol is disabled, the corresponding cipher suites will also be disabled.
Protocol
Cipher suite
When CNSA1.0 mode is enabled
Default value
TLS1.2
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
Not selectable
Enabled
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
Selectable
Enabled
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
Not selectable
Enabled
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
Selectable
Enabled
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
Not selectable
Enabled
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
Selectable
Enabled
TLS1.3
TLS_AES_128_GCM_SHA256
Not selectable
Enabled
TLS_AES_256_GCM_SHA384
Selectable
Enabled
- Minimum key length permitted for key exchange in SSL/TLS communications
-
Algorithm
Minimum key length
When CNSA1.0 mode is enabled
DHE
2048 bits (default)
Not selectable
3072 bits
Selectable
ECDHE
secp256r1 (Default)
Not selectable
secp384r1
Selectable
secp521r1
Selectable
Note: The signature algorithm, key length, and hash algorithm that are permitted by the certificate for SSL/TLS communication are set by the security operation mode.Signature algorithm
Key length
Hash algorithm
Supported when CNSA1.0 mode is enabled?
RSA
2048 bits
SHA-256
Not supported
SHA-384
Not supported
SHA-512
Not supported
3072 bits
SHA-256
Not supported
SHA-384
Supported
SHA-512
Supported
4096 bits
SHA-256
Not supported
SHA-384
Supported
SHA-512
Supported
ECDSA
secp256r1
SHA-256
Not supported
secp384r1
SHA-384
Supported
secp521r1
SHA-512
Supported