No option to enable SHAv2

[WIN PHYO AUNG]

Hi,

I am checking if my ASA support for the SHAv2. But I couldn't find any option to choose for SHAv2 for the encryption algorithm.

Anyone could suggest how to check if ASA can support SHAv2 and how to enable it?

ASA version is 8.4(7)22

Thanks

[Karsten Iwen]

The usage of SHA2 was defined in the TLS1.2 specification which is not yet supported on the ASA. So the best that can be done today is the specification of the tls-version and cipher-string in the following way:

ssl server-version tlsv1-only
ssl encryption dhe-aes256-sha1 aes256-sha1

or, as AES128 is also considered secure:

ssl server-version tlsv1-only
ssl encryption dhe-aes128-sha1 dhe-aes256-sha1 aes128-sha1 aes256-sha1

This is all for SSL/TLS. For IPsec IKEv2, SHA2 is supported.

[WIN PHYO AUNG]

Karsten Iwen ,

Thanks for the sharing. Is there any reference like the link in cisco site mentioning the support of ASA on SHA2?

Thanks

[InayathUlla Sharieff]

https://supportforums.cisco.com/discussion/12070851/cisco-asa-5510-sha-2

[WIN PHYO AUNG]

Thanks for sharing InayathUlla Sharieff.

Does anyone know if any of existing ASA IOS versions (8.4.x or 9.x) supports TLS v1.2 for SSL?

[Karsten Iwen]

Just to add:

I would expect that ASA version 9.3.2 will support SHA2 for TLS because starting with that version TLS 1.2 should be supported. This is documented in the AnyConnect 4 release-notes for Android:

TLS 1.2

AnyConnect 4.0 now supports TLS version 1.2 with the following additional cipher suites: 

• DHE-RSA-AES256-SHA256 
• DHE-RSA-AES128-SHA256 
• AES256-SHA256 
• AES128-SHA256 

Note	AnyConnect TLS 1.2 requires a secure gateway that also supports TLS 1.2, this will be available in ASA 9.3.2 and later.

[WIN PHYO AUNG]

Hi Karsten Iwen,

Thanks a lot. It helped me a lot.

Thanks

Win

[Karsten Iwen]

And another addition:

v9.3(2) is available. From now on the ASA also supports TLS 1.2! That took quite long to get there ...

[WIN PHYO AUNG]

Thanks Man!!!!