12

I have created a socket on port 443 as in the following line:

socket = (SSLSocket) factory.createSocket(hostName, port);

Then, I wanted to see the enabled ciphersuites in this socket, I used:

String[] enCiphersuite=socket.getEnabledCipherSuites();
System.out.println("Enabled ciphersuites are: "+Arrays.toString(enCiphersuite));

Then, I want to pick only one ciphersuite that I want my application to use when creating handshake with the remote server. I did the following:

String pickedCipher[] ={"TLS_RSA_WITH_AES_128_CBC_SHA"}; 
socket.setEnabledCipherSuites(pickedCipher);
System.out.println("ciphersuite set to: "+Arrays.toString(pickedCipher));

Then I made the handshake, and checked the session ciphersuite:

socket.startHandshake();
System.out.println("Session ciphersuite is"+socket.getSession().getCipherSuite() );

But I found that the name of the cipher printed in the previous printout statement after the handshake (as I understand, this is the actually used cipher in the session) is not what I set earlier using setEnabledCipherSuites()

Why am I still not see my chosen ciphersuite is the used one ? and also, I also tried to getEnabledCipherSuites() and print it out after I setEnabledCipherSuites and found the list has not changed to what I have set. I am not sure when I print the enabled ciphersuite, is this list of ciphersuites depends on Java and always the same list, or depends on the client or on the server? Can any body explain ?

EDIT: Before the handshake I only have the following lines:

SSLSocketFactory factory = HttpsURLConnection.getDefaultSSLSocketFactory(); 
SSLSocket socket=null;
try {
socket = (SSLSocket) factory.createSocket(hostName, port);
socket.setSoTimeout(15000); 
socket.startHandshake(); //handshake
.
.
4

1 回答 1

6

我发现我在 setEnableCipherSuite() 之前添加了 socket.getsession() 以便在设置之前打印出启用的密码。当我删除它时，密码已设置。这是为什么 ？

如SSLSocketJavaDoc中所述：

可以通过以下三种方式之一启动此连接的初始握手：

  • 调用显式开始握手的 startHandshake，或
  • 任何在此套接字上读取或写入应用程序数据的尝试都会导致隐式握手，或者
  • 如果当前没有有效会话，则调用 getSession 会尝试建立会话，并且完成了隐式握手。

如果您在调用getSession()之前先调用setEnabledCipherSuite()，则当您尝试设置启用的密码套件时，握手已经完成，因此该会话的密码套件已经被选中。

于 2012-12-22T23:29:12.593 回答