Make managing ciphers in QSSLCSL easier using 2-digit cipher codes and use these codes everywhere

It would be easier to manage ciphers in the system value using the 2-digit codes simply because ciphers also have to be managed in SST (SSLCONFIG/TLSCONFIG) where the 2-digit code in required when adding/removing ciphers to the eligible list. Given that there are 2 places for ciphers to be managed and usually security administrators have to initially work off something like spreadsheet to cross check (VLOOKUP) existing ciphers vs recommended ciphers and also take into account weak ciphers that may need to be dropped, it can be challenging comparing long cipher names.

It's made more challenging by the fact that when comparing cipher names as listed in the system value QSSLCSL vs ciphers as represented in the output of TLS traces, wherein the latter case, ciphers are usually prefixed with "TLS" and may include "WITH_" in the name.

Example of SSL Trace spool file

*TLS_RSA_WITH_AES_256_CBC_SHA256 (often split over 2 lines - see IBMI-I-4114)

Example of SST when using TLSCONFIG command -connectioncounts:display

*TLS_RSA_WITH_AES_256_CBC_SHA256

Example of SST when using TLSCONFIG command -display

RSA_AES_256_CBC_SHA256*

Example of system value QSSLCSL

RSA_AES_256_CBC_SHA256

Due to this, it would be far simpler if adding/removing ciphers in QSSLCSL could be done using the 2-digit codes. By all means still display the corresponding long cipher name next to it.

It would be ideal if IBM also ensured that these 2-digit codes were always shown alongside lists of cipher names in various material. An example would be this link, which is an important reference for security administrators.

https://www.ibm.com/support/pages/configuring-your-ibm-i-system-secure-sockets-layer-ssltransport-layer-security-tls-protocols-and-cipher-suites

In that link, the 2-digit codes are listed in various parts of that page, but, for example, the Weak Ciphers section lists ciphers, but not wikth the 2-digit code, so one has to go off and cross match long names from that page vs what's on your system.

Ultimately, this request is about moving from comparing long cipher names to comparing a simple list of 2-digit codes.

Phil Howells

Australia