Release Notes › Federation Security Services Release Notes › Changes to Existing Features › Two New Ciphers for SHA256 Support Across the Back Channel

Two New Ciphers for SHA256 Support Across the Back Channel

Federation uses an SSL client when processing back channel requests. You can now configure the Identity Provider to use SSL versions TLSV1_1 and TSLV1_2 with the following ciphers:

• RSA_With_AES_128_CBC_SHA256
• RSA_With_AES_256_CBC_SHA256

These ciphers are supported in FIPS and non-FIPS mode.

The determination whether to use SHA256 is made at the Identity Provider. The Service Provider broadcasts the SSL versions and ciphers that it supports. The Identity Provider is configured to accept a certain set of SSL versions and ciphers. Part of the SSL handshake includes communicating using the first configured match of versions and ciphers.

SiteMinder does not have a configuration setting for selecting the required algorithm. Administrators must verify that the Identity Provider is configured appropriately.