# A reasonable default for today's standards. For F21 it should provide
# 80-bit security and will include for compatibility and as fallback the RC4
# cipher which is known to be broken.

# MACs: SHA1+
# Curves: All supported
# Signature algorithms: must use SHA-1 hash or better
# Ciphers: AES-GCM, AES-CCM, AES-CBC, CAMELLIA-GCM, CAMELLIA-CBC, 3DES-CBC
# Key exchange: ECDHE, RSA, DHE
# DH params size: 1023+
# RSA params size: 1023+
# Protocols: All supported (TLS1.0+)

CONFIG_GNUTLS="$(cat <<EOF
SYSTEM=NONE:+VERS-TLS-ALL:-VERS-SSL3.0:\
+AEAD:+SHA1:+SHA256:+SHA384:+ECDHE-RSA:+ECDHE-ECDSA:+RSA:+DHE-RSA:+DHE-DSS:\
+AES-256-GCM:+AES-256-CCM:+AES-256-CBC:+CAMELLIA-256-GCM:+CAMELLIA-256-CBC:\
+AES-128-GCM:+AES-128-CCM:+AES-128-CBC:+CAMELLIA-128-GCM:+CAMELLIA-128-CBC:\
+3DES-CBC:+SIGN-ALL:-SIGN-RSA-MD5:+CURVE-ALL:+COMP-NULL:%PROFILE_LOW
EOF
)"

CONFIG_GNUTLS28="$(cat <<EOF
SYSTEM=NONE:+VERS-TLS-ALL:-VERS-SSL3.0:\
+AEAD:+SHA1:+SHA256:+SHA384:+ECDHE-RSA:+ECDHE-ECDSA:+RSA:+DHE-RSA:+DHE-DSS:\
+AES-256-GCM:+AES-256-CBC:+CAMELLIA-256-GCM:+CAMELLIA-256-CBC:\
+AES-128-GCM:+AES-128-CBC:+CAMELLIA-128-GCM:+CAMELLIA-128-CBC:\
+3DES-CBC:+SIGN-ALL:-SIGN-RSA-MD5:+CURVE-ALL:+COMP-NULL:%PROFILE_LOW
EOF
)"

# We cannot limit the TLS version number in openssl, thus we cannot disable
# SSL 3.0, nor specify minimum sizes for DH or RSA parameters.
CONFIG_OPENSSL="$(cat <<EOF
!SSLv2:kEECDH:kRSA:kEDH:kPSK:+3DES:!aNULL:!eNULL:!MD5:!EXP:!RC4:!SEED:!IDEA:!DES
EOF
)"


# Configuration for Bind
CONFIG_BIND="$(cat <<EOF
disable-algorithms "."  {
RSAMD5;
};
EOF
)"

# Configuration for Java
CONFIG_JAVA="$(cat <<EOF
jdk.certpath.disabledAlgorithms=MD2, MD5, RSA keySize < 1023
jdk.tls.disabledAlgorithms=SSLv2, SSLv3, DH keySize < 1023, HmacMD5, K_NULL, \
 C_NULL, M_NULL, DHE_DSS_EXPORT, DHE_RSA_EXPORT, DH_anon_EXPORT, DH_DSS_EXPORT, \
 DH_RSA_EXPORT, RSA_EXPORT, DH_anon, ECDH_anon, RC4_128, RC4_40, DES_CBC, \
 DES40_CBC, RC2
jdk.tls.legacyAlgorithms=
EOF
)"

# Configuration for libkrb5
CONFIG_KRB5="$(cat <<EOF
# This file is automatically generated by update-crypto-policies.
permitted_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 des3-cbc-sha1 camellia256-cts-cmac camellia128-cts-cmac
EOF
)"
