File

mod_tls_policy/README.markdown @ 1842:98ad01cc83cf

mod_tls_policy: Add README
author Kim Alvefur <zash@zash.se>
date Sat, 12 Sep 2015 21:02:33 +0200
child 1843:032b209bb8ff
line wrap: on
line source

% Cipher policy enforcement with application level error reporting

# Introduction

This module arose from discussions at the XMPP Summit about enforcing 
better ciphers in TLS.  It may seem attractive to disallow some 
insecure ciphers or require forward secrecy, but doing this at the TLS 
level would the user with an unhelpful "Encryption failed" message.  
This module does this enforcing at the application level, allowing 
better error messages.

# Configuration

First, download and add the module to `module_enabled`.  Then you can 
decide on what policy you want to have.

Requiring ciphers with forward secrecy is the most simple to set up.

``` lua
tls_policy = "FS" -- allow only ciphers that enable forward secrecy
```

A more complicated example:

``` lua
tls_policy = {
  c2s = {
    encryption = "AES"; -- Require AES (or AESGCM) encryption
    protocol = "TLSv1.2"; -- and TLSv1.2
    bits = 128; -- and at least 128 bits (FIXME: remember what this meant)
  }
  s2s = {
    cipher = "AESGCM"; -- Require AESGCM ciphers
    protocol = "TLSv1.[12]"; -- and TLSv1.1 or 1.2
    authentication = "RSA"; -- with RSA authentication
  };
}
```

# Compatibility

Requires LuaSec 0.5