| ATNA Support update for the OHF IHE Plugins and OHF Bridge [message #24359] |
Wed, 22 November 2006 01:19  |
Eclipse User |
|
|
|
Originally posted by: rgd.us.ibm.com
We've succesfully tested ATNA TLS with the MESA TLS Tests, and with the
IBM test services on lswin10.dfw.ibm.com.
As Sarah mentioned in another post, we have a bug open against the NIST
test server. For some reason we are getting a handshake failure with
that one system - all the others we've tested against are doing TLS just
fine with the OHF plugins.
One important note we've raised with the IHE, and are awaiting a
response - is that the Sun JVMs 1.4.2 and 1.5.x don't provide support
for the TLS cipher TLS_RSA_WITH_NULL_SHA. This is specified by the
ATNA profile as the unencrypted cipher to use. Currently we've
substituted the simliar cipher SSL_RSA_WITH_NULL_SHA in the OHF ATNA
code, and with this cipher we've succesfully passed the required MESA
TLS tests 1221, 1222, 1223.
regards,
glenn deen (IBM OHF team)
|
|
|
|
|
|
|
|
| Re: ATNA Support update for the OHF IHE Plugins and OHF Bridge [message #575451 is a reply to message #24359] |
Thu, 23 November 2006 01:11  |
| Eclipse User |
|
|
|
Glenn wrote:
>
> We've succesfully tested ATNA TLS with the MESA TLS Tests, and with the
> IBM test services on lswin10.dfw.ibm.com.
>
> As Sarah mentioned in another post, we have a bug open against the NIST
> test server. For some reason we are getting a handshake failure with
> that one system - all the others we've tested against are doing TLS just
> fine with the OHF plugins.
>
> One important note we've raised with the IHE, and are awaiting a
> response - is that the Sun JVMs 1.4.2 and 1.5.x don't provide support
> for the TLS cipher TLS_RSA_WITH_NULL_SHA. This is specified by the
> ATNA profile as the unencrypted cipher to use. Currently we've
> substituted the simliar cipher SSL_RSA_WITH_NULL_SHA in the OHF ATNA
> code, and with this cipher we've succesfully passed the required MESA
> TLS tests 1221, 1222, 1223.
>
> regards,
> glenn deen (IBM OHF team)
>
Update - SSL_RSA_WITH_NULL_SHA is 100% equivalent in Java to
TLS_RSA_WITH_NULL_SHA. The name is different, but the actual cipher ID
sent to the server is the same as TLS_RSA_WITH_NULL_SHA. I've updated
the ATNA transport code with this cipher name. So it's now good to go.
I've tested it with MESA and it's succesfully negotating the TLS handshake.
-glenn
|
|
|
|
|
|
|
Powered by
FUDForum. Page generated in 0.03950 seconds
Home