ÿØÿà JFIF    ÿÛ „ ( %!1!%*+...983,7(-.- PK;/]øã66 FUTURE.polnu„[µü¤# A level that will provide security on a conservative level that is # believed to withstand any near-term future attacks. And also provide # some (not complete) preparation for post quantum encryption support # in form of 256 bit symmetric encryption requirement. # It provides at least an 128-bit security. This level may prevent # communication with many used systems that provide weaker security levels # (e.g., systems that use SHA-1 as signature algorithm). # MACs: all HMAC with SHA256 or better + all modern MACs (Poly1305 etc) # Curves: all prime >= 255 bits (including Bernstein curves) # Signature algorithms: with SHA-256 hash or better (no DSA) # TLS Ciphers: >= 256-bit key, >= 128-bit block, only Authenticated Encryption (AE) ciphers, no CBC ciphers # non-TLS Ciphers: same as TLS Ciphers with added non AE ciphers, CBC only for Kerberos # key exchange: ECDHE, DHE (no DHE-DSS) # DH params size: >= 3072 # RSA params size: >= 3072 # TLS protocols: TLS >= 1.2, DTLS >= 1.2 mac = AEAD HMAC-SHA2-256 UMAC-128 HMAC-SHA2-384 HMAC-SHA2-512 mac@Kerberos = HMAC-SHA2-384 HMAC-SHA2-256 AEAD UMAC-128 HMAC-SHA2-512 group = X25519 X448 SECP256R1 SECP384R1 SECP521R1 \ FFDHE-3072 FFDHE-4096 FFDHE-6144 FFDHE-8192 hash = SHA2-256 SHA2-384 SHA2-512 SHA3-256 SHA3-384 SHA3-512 sign = ECDSA-SHA3-256 ECDSA-SHA2-256 \ ECDSA-SHA3-384 ECDSA-SHA2-384 \ ECDSA-SHA3-512 ECDSA-SHA2-512 \ EDDSA-ED25519 EDDSA-ED448 \ RSA-PSS-SHA2-256 RSA-PSS-SHA2-384 RSA-PSS-SHA2-512 \ RSA-SHA3-256 RSA-SHA2-256 \ RSA-SHA3-384 RSA-SHA2-384 \ RSA-SHA3-512 RSA-SHA2-512 cipher = AES-256-GCM AES-256-CCM CHACHA20-POLY1305 CAMELLIA-256-GCM \ AES-256-CTR cipher@Kerberos = AES-256-CBC+ CAMELLIA-256-CBC+ cipher@TLS = AES-256-GCM AES-256-CCM CHACHA20-POLY1305 key_exchange = ECDHE DHE DHE-RSA PSK DHE-PSK ECDHE-PSK ECDHE-GSS DHE-GSS protocol@TLS = TLS1.3 TLS1.2 DTLS1.2 protocol@IKE = IKEv2 # Parameter sizes min_dh_size = 3072 min_dsa_size = 3072 min_rsa_size = 3072 # GnuTLS only for now sha1_in_certs = 0 arbitrary_dh_groups = 1 ssh_certs = 1 ssh_etm = 1 PK;/]}srÅ   EMPTY.polnu„[µü¤# Just an empty policy for testing mac = group = hash = sign = cipher = key_exchange = #protocol = # Parameter sizes min_dh_size = 0 min_dsa_size = 0 min_rsa_size = 0 # GnuTLS only for now sha1_in_certs = 0 arbitrary_dh_groups = 0 ssh_certs = 0 ssh_etm = 0 PK;/]V'G§ § LEGACY.polnu„[µü¤# Provides settings for ensuring maximum compatibility with legacy systems. # This policy is less secure and intended to be a easy way to switch system # to be compatible with older systems. # It should provide at least 64-bit security and include RC4 and 3DES. # MACs: all HMAC with SHA1 or better + all modern MACs (Poly1305 etc) # Curves: all prime >= 255 bits (including Bernstein curves) # Signature algorithms: with SHA-1 hash or better (DSA allowed) # TLS Ciphers: all available > 112-bit key, >= 128-bit block (including RC4 and 3DES) # non-TLS Ciphers: as TLS Ciphers with added Camellia # key exchange: ECDHE, RSA, DHE # DH params size: >= 1023 # RSA params size: >= 1023 # DSA params size: >= 1023 # TLS protocols: TLS >= 1.0 DTLS >= 1.0 mac = AEAD HMAC-SHA2-256 HMAC-SHA1 UMAC-128 HMAC-SHA2-384 HMAC-SHA2-512 mac@Kerberos = HMAC-SHA2-384 HMAC-SHA2-256 AEAD UMAC-128 HMAC-SHA2-512 HMAC-SHA1 group = X25519 X448 SECP256R1 SECP384R1 SECP521R1 \ FFDHE-2048 FFDHE-3072 FFDHE-4096 FFDHE-6144 FFDHE-8192 FFDHE-1536 group@SSH = FFDHE-1024+ hash = SHA2-256 SHA2-384 SHA2-512 SHA3-256 SHA3-384 SHA3-512 SHA2-224 SHA1 sign = ECDSA-SHA3-256 ECDSA-SHA2-256 \ ECDSA-SHA3-384 ECDSA-SHA2-384 \ ECDSA-SHA3-512 ECDSA-SHA2-512 \ EDDSA-ED25519 EDDSA-ED448 \ RSA-PSS-SHA2-256 RSA-PSS-SHA2-384 RSA-PSS-SHA2-512 \ RSA-SHA3-256 RSA-SHA2-256 \ RSA-SHA3-384 RSA-SHA2-384 \ RSA-SHA3-512 RSA-SHA2-512 \ ECDSA-SHA2-224 RSA-PSS-SHA2-224 RSA-SHA2-224 \ DSA-SHA2-256 DSA-SHA2-384 DSA-SHA2-512 DSA-SHA2-224 \ DSA-SHA3-256 DSA-SHA3-384 DSA-SHA3-512 \ ECDSA-SHA1 RSA-PSS-SHA1 RSA-SHA1 DSA-SHA1 cipher = AES-256-GCM AES-256-CCM CHACHA20-POLY1305 CAMELLIA-256-GCM \ AES-256-CTR AES-256-CBC CAMELLIA-256-CBC AES-128-GCM AES-128-CCM \ CAMELLIA-128-GCM AES-128-CTR AES-128-CBC CAMELLIA-128-CBC \ 3DES-CBC RC4-128 cipher@TLS = AES-256-GCM AES-256-CCM CHACHA20-POLY1305 AES-256-CBC \ AES-128-GCM AES-128-CCM AES-128-CBC 3DES-CBC RC4-128 # 'RSA' is intentionally before DHE ciphersuites, as the DHE ciphersuites have # interoperability issues in TLS. key_exchange = ECDHE RSA DHE DHE-RSA DHE-DSS PSK DHE-PSK ECDHE-PSK ECDHE-GSS DHE-GSS protocol@TLS = TLS1.3 TLS1.2 TLS1.1 TLS1.0 DTLS1.2 DTLS1.0 protocol@IKE = IKEv2 # Parameter sizes min_dh_size = 1023 min_dsa_size = 1023 min_rsa_size = 1023 # GnuTLS only for now sha1_in_certs = 1 arbitrary_dh_groups = 1 ssh_certs = 1 ssh_etm = 1 PK;/]AˆšÝii DEFAULT.polnu„[µü¤# A reasonable default for today's standards. It should provide # 112-bit security with the exception of SHA1 signatures needed for DNSSec # and other still prevalent legacy use of SHA1 signatures. # MACs: all HMAC with SHA1 or better + all modern MACs (Poly1305 etc) # Curves: all prime >= 255 bits (including Bernstein curves) # Signature algorithms: with SHA-1 hash or better (no DSA) # TLS Ciphers: >= 128-bit key, >= 128-bit block (AES, ChaCha20, including AES-CBC) # non-TLS Ciphers: as TLS Ciphers with added Camellia # key exchange: ECDHE, RSA, DHE (no DHE-DSS) # DH params size: >= 2048 # RSA params size: >= 2048 # TLS protocols: TLS >= 1.2, DTLS >= 1.2 mac = AEAD HMAC-SHA2-256 HMAC-SHA1 UMAC-128 HMAC-SHA2-384 HMAC-SHA2-512 mac@Kerberos = HMAC-SHA2-384 HMAC-SHA2-256 AEAD UMAC-128 HMAC-SHA2-512 HMAC-SHA1 group = X25519 X448 SECP256R1 SECP384R1 SECP521R1 \ FFDHE-2048 FFDHE-3072 FFDHE-4096 FFDHE-6144 FFDHE-8192 hash = SHA2-256 SHA2-384 SHA2-512 SHA3-256 SHA3-384 SHA3-512 SHA2-224 SHA1 sign = ECDSA-SHA3-256 ECDSA-SHA2-256 \ ECDSA-SHA3-384 ECDSA-SHA2-384 \ ECDSA-SHA3-512 ECDSA-SHA2-512 \ EDDSA-ED25519 EDDSA-ED448 \ RSA-PSS-SHA2-256 RSA-PSS-SHA2-384 RSA-PSS-SHA2-512 \ RSA-SHA3-256 RSA-SHA2-256 \ RSA-SHA3-384 RSA-SHA2-384 \ RSA-SHA3-512 RSA-SHA2-512 \ ECDSA-SHA2-224 RSA-PSS-SHA2-224 RSA-SHA2-224 \ ECDSA-SHA1 RSA-PSS-SHA1 RSA-SHA1 cipher = AES-256-GCM AES-256-CCM CHACHA20-POLY1305 CAMELLIA-256-GCM \ AES-256-CTR AES-256-CBC CAMELLIA-256-CBC AES-128-GCM AES-128-CCM \ CAMELLIA-128-GCM AES-128-CTR AES-128-CBC CAMELLIA-128-CBC cipher@TLS = AES-256-GCM AES-256-CCM CHACHA20-POLY1305 AES-256-CBC \ AES-128-GCM AES-128-CCM AES-128-CBC # 'RSA' is intentionally before DHE ciphersuites, as the DHE ciphersuites have # interoperability issues in TLS. key_exchange = ECDHE RSA DHE DHE-RSA PSK DHE-PSK ECDHE-PSK ECDHE-GSS DHE-GSS protocol@TLS = TLS1.3 TLS1.2 DTLS1.2 protocol@IKE = IKEv2 # Parameter sizes min_dh_size = 2048 min_dsa_size = 2048 min_rsa_size = 2048 # GnuTLS only for now sha1_in_certs = 1 arbitrary_dh_groups = 1 ssh_certs = 1 ssh_etm = 1 PK;/]âËBBmodules/AD-SUPPORT.pmodnu„[µü¤# AD-SUPPORT policy module is intended to be used in Active Directory # environments where either accounts or trusted domain objects were not yet # migrated to AES or future encryption types. Active Directory implicitly # requires RC4 encryption in Kerberos by default. cipher@kerberos = RC4-128+ mac@kerberos = HMAC-MD5+ PK;/]{Ñ»pZZmodules/NO-CAMELLIA.pmodnu„[µü¤# This is an example policy dropping the Camellia support altogether cipher = -CAMELLIA-* PK;/]ºØR;yymodules/ECDHE-ONLY.pmodnu„[µü¤# This is an example of policy module enforcing ECDHE and ECDHE with PSK # key exchanges key_exchange = ECDHE ECDHE-PSK PK;/]9††ï{{modules/NO-SHA1.pmodnu„[µü¤# This is an example subpolicy dropping the SHA1 hash and signature support hash = -SHA1 sign = -*-SHA1 sha1_in_certs = 0 PK;/]çˆBßÂÂmodules/OSPP.pmodnu„[µü¤# Restrict FIPS policy for the Common Criteria OSPP profile. # SSH (upper limit) # Ciphers: aes128-ctr, aes256-ctr, aes128-cbc, aes256-cbc, aes128-gcm@openssh.com, aes256-gcm@openssh.com # PubkeyAcceptedKeyTypes: rsa-sha2-256, rsa‑sha2‑512, ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521 # MACs: hmac-sha2-256, hmac-sha2-512, implicit for aes128-gcm@openssh.com, aes256-gcm@openssh.com # KexAlgorithms: ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521, diffie-hellman-group14-sha256, diffie-hellman-group16-sha512, diffie-hellman-group18-sha512 # TLS ciphers (suggested minimal set for openssl) # * TLS_RSA_WITH_AES_128_CBC_SHA - excluded by FIPS, uses RSA key exchange # * TLS_RSA_WITH_AES_256_CBC_SHA - excluded by FIPS, uses RSA key exchange # * TLS_RSA_WITH_AES_128_CBC_SHA256 - excluded by FIPS, uses RSA key exchange # * TLS_RSA_WITH_AES_256_CBC_SHA256 - excluded by FIPS, uses RSA key exchange # * TLS_RSA_WITH_AES_128_GCM_SHA256 - excluded by FIPS, uses RSA key exchange # * TLS_RSA_WITH_AES_256_GCM_SHA384 - excluded by FIPS, uses RSA key exchange # * TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 # * TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 # * TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 # * TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 # * TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 # * TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 # * TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 - disabled in openssl itself # * TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 # * TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 # * TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 # * TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 - disabled in openssl itself # * TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 # Supported Groups Extension in ClientHello: secp256r1, secp384r1, secp521r1 mac = -HMAC-SHA1 # see above, both SSH and TLS ended up not using it hash = -SHA2-224 -SHA3-* sign = -*-SHA2-224 cipher = -AES-*-CCM cipher@!{ssh,tls} = -AES-*-CTR ssh_certs = 0 ssh_etm = 0 protocol@TLS = -TLS1.3 arbitrary_dh_groups = 0 PK;/]šü´¾¾FIPS.polnu„[µü¤# Only FIPS approved or allowed algorithms. It does not provide FIPS compliace # by itself, the FIPS validated crypto modules must be properly installed # and the machine must be booted into the FIPS mode. # MACs: all HMAC with SHA1 or better # Curves: all prime >= 256 bits # Signature algorithms: with SHA224 hash or better (no DSA) # TLS Ciphers: >= 128-bit key, >= 128-bit block (AES, including AES-CBC) # non-TLS Ciphers: same # key exchange: ECDHE, RSA, DHE (no DHE-DSS) # DH params size: >= 2048 # RSA params size: >= 2048 # TLS protocols: TLS >= 1.2, DTLS >= 1.2 mac = AEAD HMAC-SHA2-256 HMAC-SHA1 HMAC-SHA2-384 HMAC-SHA2-512 mac@Kerberos = HMAC-SHA2-384 HMAC-SHA2-256 AEAD UMAC-128 HMAC-SHA2-512 HMAC-SHA1 group = SECP256R1 SECP384R1 SECP521R1 \ FFDHE-2048 FFDHE-3072 FFDHE-4096 FFDHE-6144 FFDHE-8192 hash = SHA2-256 SHA2-384 SHA2-512 SHA2-224 SHA3-256 SHA3-384 SHA3-512 sign = ECDSA-SHA3-256 ECDSA-SHA2-256 \ ECDSA-SHA3-384 ECDSA-SHA2-384 \ ECDSA-SHA3-512 ECDSA-SHA2-512 \ RSA-PSS-SHA2-256 RSA-PSS-SHA2-384 RSA-PSS-SHA2-512 \ RSA-SHA3-256 RSA-SHA2-256 \ RSA-SHA3-384 RSA-SHA2-384 \ RSA-SHA3-512 RSA-SHA2-512 \ ECDSA-SHA2-224 RSA-PSS-SHA2-224 RSA-SHA2-224 cipher = AES-256-GCM AES-256-CCM AES-256-CTR AES-256-CBC \ AES-128-GCM AES-128-CCM AES-128-CTR AES-128-CBC cipher@TLS = AES-256-GCM AES-256-CCM AES-256-CBC \ AES-128-GCM AES-128-CCM AES-128-CBC key_exchange = ECDHE DHE DHE-RSA PSK DHE-PSK ECDHE-PSK protocol@TLS = TLS1.3 TLS1.2 DTLS1.2 protocol@IKE = IKEv2 # Parameter sizes min_dh_size = 2048 min_dsa_size = 2048 min_rsa_size = 2048 # GnuTLS only for now sha1_in_certs = 0 arbitrary_dh_groups = 1 ssh_certs = 1 ssh_etm = 1 PK;/]øã66 FUTURE.polnu„[µü¤PK;/]}srÅ   pEMPTY.polnu„[µü¤PK;/]V'G§ § ´ LEGACY.polnu„[µü¤PK;/]AˆšÝii •DEFAULT.polnu„[µü¤PK;/]âËBB9modules/AD-SUPPORT.pmodnu„[µü¤PK;/]{Ñ»pZZÂmodules/NO-CAMELLIA.pmodnu„[µü¤PK;/]ºØR;yydmodules/ECDHE-ONLY.pmodnu„[µü¤PK;/]9††ï{{$modules/NO-SHA1.pmodnu„[µü¤PK;/]çˆBßÂÂãmodules/OSPP.pmodnu„[µü¤PK;/]šü´¾¾æ'FIPS.polnu„[µü¤PK Ü.