Java 8更新后与RC4相关的问题 [英] RC4 related issue after Java 8 update

问题描述

当时启用了Java RC4的早期版本，我的应用程序运行良好，但是在Java 8 U 77更新后，它不再使用需要与我的一台旧服务器配合使用的以下密码.

In previous version of Java RC4 was enabled at that time my app worked fine but after Java 8 U 77 update it doesn't any more use the following ciphers which are need to work with one of my legacy servers.

TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
TLS_ECDHE_RSA_WITH_RC4_128_SHA
SSL_RSA_WITH_RC4_128_SHA
TLS_ECDH_ECDSA_WITH_RC4_128_SHA
TLS_ECDH_RSA_WITH_RC4_128_SHA
SSL_RSA_WITH_RC4_128_MD5

我修改了java.security和禁用的算法部分，如下所示，

I modified the java.security and the disabled algorithm section look like below,

jdk.certpath.disabledAlgorithms=MD2, RSA keySize < 1024

仍然无法使以上套件正常工作.启用它们的任何想法，我也尝试在运行应用程序时添加它们，

Still I can't get the above suites working. Any idea of enabling them, I also tried adding them when running the application,

java -Djavax.net.debug=all -Djavax.net.debug=ssl:handshake:verbose -Dhttps.cipherSuites="TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,TLS_ECDHE_RSA_WITH_RC4_128_SHA,SSL_RSA_WITH_RC4_128_SHA,TLS_ECDH_ECDSA_WITH_RC4_128_SHA,TLS_ECDH_RSA_WITH_RC4_128_SHA,SSL_RSA_WITH_RC4_128_MD5" <myApp>

仍然没有运气，在此先感谢.

Still no luck, Thanks in advance.

推荐答案

The release notes of Oracle JRE 8u51 mention a new security property called jdk.tls.legacyAlgorithms to which RC4 has been added:

RC4现在被认为是弱密码.除非客户端请求的密码套件中没有其他更强的候选者，否则服务器不应选择RC4.添加了新的安全性属性jdk.tls.legacyAlgorithms，以在Oracle JSSE实现中定义旧式算法.与RC4相关的算法已添加到旧算法列表中.

RC4 is now considered as a weak cipher. Servers should not select RC4 unless there is no other stronger candidate in the client requested cipher suites. A new security property, jdk.tls.legacyAlgorithms, is added to define the legacy algorithms in Oracle JSSE implementation. RC4 related algorithms are added to the legacy algorithms list.

我假设您必须从java.security文件的该属性列表中删除RC4_40，以使其再次可用.

I assume that you have to remove RC4_40 from that property list in the java.security file to make it usable again.

这篇关于Java 8更新后与RC4相关的问题的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！