According to Java 7 documentation as well as third party vendors, it appears Java 7 should support AES-GCM suites:
I was hitting some errors in negotiation between client and server unable to negotiate a cipher due to restricting it to only the AES-GCM ciphers. After investigation I found that it appears that the cipher suites are not supported on client nor server (tomcat instance). Ran some sample code on client to get the output:
// Create an SSLContext that uses our TrustManagerSSLContext context = SSLContext.getInstance("TLS");context.init(null, trustAllCerts, new SecureRandom());SSLParameters params = context.getSupportedSSLParameters();String[] suites = params.getCipherSuites();System.out.println("Java version : " + System.getProperty("java.runtime.version"));System.out.println("Connecting with " + suites.length + " cipher suites supported:");for (int i = 0; i < suites.length; i++) { System.out.println(); System.out.print(" ********* "); System.out.print(suites[i]); System.out.print(" ********* ");}Java version: 1.7.0_51-b13Connecting with 63 cipher suites supported: ********* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 ********* ********* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 ********* ********* TLS_RSA_WITH_AES_128_CBC_SHA256 ********* ********* TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 ********* ********* TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 ********* ********* TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 ********* ********* TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 ********* ********* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA ********* ********* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA ********* ********* TLS_RSA_WITH_AES_128_CBC_SHA ********* ********* TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA ********* ********* TLS_ECDH_RSA_WITH_AES_128_CBC_SHA ********* ********* TLS_DHE_RSA_WITH_AES_128_CBC_SHA ********* ********* TLS_DHE_DSS_WITH_AES_128_CBC_SHA ********* ********* TLS_ECDHE_ECDSA_WITH_RC4_128_SHA ********* ********* TLS_ECDHE_RSA_WITH_RC4_128_SHA ********* ********* SSL_RSA_WITH_RC4_128_SHA ********* ********* TLS_ECDH_ECDSA_WITH_RC4_128_SHA ********* ********* TLS_ECDH_RSA_WITH_RC4_128_SHA ********* ********* TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA ********* ********* TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA ********* ********* SSL_RSA_WITH_3DES_EDE_CBC_SHA ********* ********* TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA ********* ********* TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA ********* ********* SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA ********* ********* SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA ********* ********* SSL_RSA_WITH_RC4_128_MD5 ********* ********* TLS_EMPTY_RENEGOTIATION_INFO_SCSV ********* ********* TLS_DH_anon_WITH_AES_128_CBC_SHA256 ********* ********* TLS_ECDH_anon_WITH_AES_128_CBC_SHA ********* ********* TLS_DH_anon_WITH_AES_128_CBC_SHA ********* ********* TLS_ECDH_anon_WITH_RC4_128_SHA ********* ********* SSL_DH_anon_WITH_RC4_128_MD5 ********* ********* TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA ********* ********* SSL_DH_anon_WITH_3DES_EDE_CBC_SHA ********* ********* TLS_RSA_WITH_NULL_SHA256 ********* ********* TLS_ECDHE_ECDSA_WITH_NULL_SHA ********* ********* TLS_ECDHE_RSA_WITH_NULL_SHA ********* ********* SSL_RSA_WITH_NULL_SHA ********* ********* TLS_ECDH_ECDSA_WITH_NULL_SHA ********* ********* TLS_ECDH_RSA_WITH_NULL_SHA ********* ********* TLS_ECDH_anon_WITH_NULL_SHA ********* ********* SSL_RSA_WITH_NULL_MD5 ********* ********* SSL_RSA_WITH_DES_CBC_SHA ********* ********* SSL_DHE_RSA_WITH_DES_CBC_SHA ********* ********* SSL_DHE_DSS_WITH_DES_CBC_SHA ********* ********* SSL_DH_anon_WITH_DES_CBC_SHA ********* ********* SSL_RSA_EXPORT_WITH_RC4_40_MD5 ********* ********* SSL_DH_anon_EXPORT_WITH_RC4_40_MD5 ********* ********* SSL_RSA_EXPORT_WITH_DES40_CBC_SHA ********* ********* SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA ********* ********* SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA ********* ********* SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA ********* ********* TLS_KRB5_WITH_RC4_128_SHA ********* ********* TLS_KRB5_WITH_RC4_128_MD5 ********* ********* TLS_KRB5_WITH_3DES_EDE_CBC_SHA ********* ********* TLS_KRB5_WITH_3DES_EDE_CBC_MD5 ********* ********* TLS_KRB5_WITH_DES_CBC_SHA ********* ********* TLS_KRB5_WITH_DES_CBC_MD5 ********* ********* TLS_KRB5_EXPORT_WITH_RC4_40_SHA ********* ********* TLS_KRB5_EXPORT_WITH_RC4_40_MD5 ********* ********* TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA ********* ********* TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5 ********* INFO - Received response from post device of : Did not know if anyone else has come across such an issue.
Does Java 7 support use of AES-GCM in SSL/TLS?
Advertisement
Answer
AES-GCM is available in TLS v1.2. See [The Transport Layer Security (TLS) Protocol Version 1.2][1], section 6.2.3.3. TLSv1.1 did not add any cipher suites, and TLSv1.0 never had AES-GCM or the elliptic curve gear. (The elliptic curve stuff showed up in TLSv1.2 also).
The latest public build 80 of Java 7
does support TLSv1.2 after changing code to use
SSLContext.getInstance("TLSv1.2")in case of socket programming or just declaring the-Dhttps.protocols=TLSv1.2in case of HTTP programming.does not support the AES-GCM cipher suite even under TLSv1.2, according to a request implemented only in a commercial build 191 of Java 7,
https://bugs.java.com/bugdatabase/view_bug.do?bug_id=8180834
Its interesting that the TLS_ECDHE_ECDSA_* cipher suites are showing up in your dump since they are TLSv1.2 ciphers.