Oracle Database B10772-01 Administrator's Manual page 194

Enabling SSL
Step 4: Set the Client SSL Cipher Suites (Optional)
A cipher suite is a set of authentication, encryption, and data integrity algorithms
used for exchanging messages between network entities. During an SSL handshake,
two entities negotiate to see which cipher suite they will use when transmitting
messages back and forth.
When you install Oracle Advanced Security,the SSL cipher suites listed in
are set for you by default. This table lists them in the order they are tried when two
entities are negotiating a connection. You can override the default by setting the
SSL_CIPHER_SUITES parameter. For example, if you use Oracle Net Manager to
add the cipher suite SSL_RSA_WITH_RC4_128_SHA, all other cipher suites in the
default setting are ignored.
You can prioritize the cipher suites. When the client negotiates with servers
regarding which cipher suite to use, it follows the prioritization you set. When you
prioritize the cipher suites, consider the following:
You typically prioritize cipher suites starting with the strongest and moving to the
weakest.
Table 7–1
Advanced Security. These cipher suites are set by default when you install Oracle
Advanced Security. This table also lists the authentication, encryption, and data
integrity types each cipher suite uses.
7-28 Oracle Database Advanced Security Administrator's Guide
The level of security you want to use. For example, triple-DES encryption is
stronger than DES.
The impact on performance. For example, triple-DES encryption is slower than
DES. See "Configuring Your System to Use Hardware Security Modules"
page 7-48 for information about using SSL hardware accelerators with Oracle
Advanced Security.
Administrative requirements:
The cipher suites selected for a client must be compatible with those required
by the server. For example, in the case of an Oracle Call Interface (OCI) user, the
server requires the client to authenticate itself. You cannot, in this case, use a
cipher suite employing Diffie-Hellman anonymous authentication which
disallows the exchange of certificates.
lists the SSL cipher suites supported in the current release of Oracle
Table 7–1
on