[研究] Windows Server 2019 + IIS + nmap 7.80 支援加密演算法最大長度金鑰 測試
資通安全責任等級分級辦法 EN
附表十 資通系統防護基準.PDF
控制措施－構面：系統與通訊保護
控制措施－措施內容：傳輸之機密性與完整性
系統防護需求分級：（高等級系統）支援演算法最大長度金鑰。
環境
Windows Server 2019 + IIS + nmap 7.80
測試
nmap --script ssl-cert,ssl-enum-ciphers -p 443 192.168.128.128
********************************************************************************
Starting Nmap 7.80 ( https://nmap.org ) at 2020-10-02 08:52 ￥x￥_?D·CRE?!
Nmap scan report for 192.168.128.128
Host is up (0.00s latency).
PORT STATE SERVICE
443/tcp open https
| ssl-cert: Subject: commonName=WIN2019A
| Subject Alternative Name: DNS:WIN2019A
| Issuer: commonName=WIN2019A
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2020-10-02T00:51:56
| Not valid after: 2021-10-02T00:00:00
| MD5: 883d e1ac 62ad f978 6abf 1144 5fe9 0ce2
|_SHA-1: a815 e8b5 8f66 cb24 6d2d 237b 8902 f8e1 1c79 5f45
| ssl-enum-ciphers:
| TLSv1.0:
| ciphers:
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp384r1) - A
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (ecdh_x25519) - A
| TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
| TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
| TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C
| compressors:
| NULL
| cipher preference: server
| warnings:
| 64-bit block cipher 3DES vulnerable to SWEET32 attack
| TLSv1.1:
| ciphers:
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp384r1) - A
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (ecdh_x25519) - A
| TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
| TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
| TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C
| compressors:
| NULL
| cipher preference: server
| warnings:
| 64-bit block cipher 3DES vulnerable to SWEET32 attack
| TLSv1.2:
| ciphers:
| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp384r1) - A
| TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A
| TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 2048) - A
| TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (dh 2048) - A
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp384r1) - A
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (ecdh_x25519) - A
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp384r1) - A
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (ecdh_x25519) - A
| TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048) - A
| TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048) - A
| TLS_RSA_WITH_AES_256_CBC_SHA256 (rsa 2048) - A
| TLS_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A
| TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
| TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
| TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C
| compressors:
| NULL
| cipher preference: server
| warnings:
| 64-bit block cipher 3DES vulnerable to SWEET32 attack
|_ least strength: C
MAC Address: 00:0C:29:DB:2D:98 (VMware)
Nmap done: 1 IP address (1 host up) scanned in 2.53 seconds
********************************************************************************
結果：
支援 AES_256
支援 SHA384，沒有 SHA512
支援 rsa 2048，沒有 rsa 4096
這是預設支援的，根據 SSDLC 的安全建議，有些建議關閉。
IIS Crypto Version 3.2 Build 16 - Released April 11, 2020
另外也可用 SSL Labs 網站進行測試。
https://www.ssllabs.com/ssltest/
(完)
相關
進階加密標準（英語：Advanced Encryption Standard，縮寫：AES） - 維基百科，自由的百科全書
https://zh.wikipedia.org/wiki/%E9%AB%98%E7%BA%A7%E5%8A%A0%E5%AF%86%E6%A0%87%E5%87%86
SHA家族 - 維基百科，自由的百科全書
https://zh.wikipedia.org/wiki/SHA%E5%AE%B6%E6%97%8F
RSA加密演算法 - 維基百科，自由的百科全書
https://zh.wikipedia.org/wiki/RSA%E5%8A%A0%E5%AF%86%E6%BC%94%E7%AE%97%E6%B3%95
沒有留言:
張貼留言