CipherSuitesPolicy()
public CipherSuitesPolicy()
Initializes a new instance of the CipherSuitesPolicy class with a default policy that allows all cipher suites supported by the underlying operating system.
Namespace: System.Net.Security
Provides a mechanism to customize the set of cipher suites that are allowed for Transport Layer Security (TLS) connections.
This class is used to specify which SSL/TLS cipher suites can be negotiated between a client and a server. By default, .NET uses a system-defined list of cipher suites. However, you can use the CipherSuitesPolicy class to create a more restrictive or permissive policy.
public class CipherSuitesPolicyAssembly: System.Net.Security.dll
public CipherSuitesPolicy()
Initializes a new instance of the CipherSuitesPolicy class with a default policy that allows all cipher suites supported by the underlying operating system.
public CipherSuitesPolicy(IEnumerable<TlsCipherSuite> allowedCipherSuites)
IEnumerable<TlsCipherSuite> that specifies the list of allowed cipher suites.Initializes a new instance of the CipherSuitesPolicy class with a specific set of allowed cipher suites.
public IEnumerable<TlsCipherSuite> AllowedCipherSuites { get; }
Gets the collection of cipher suites that are allowed by this policy.
public void Add(TlsCipherSuite cipherSuite)
TlsCipherSuite to add to the allowed list.Adds a specific cipher suite to the allowed list for this policy.
public void AddRange(IEnumerable<TlsCipherSuite> cipherSuites)
TlsCipherSuite to add to the allowed list.Adds a collection of cipher suites to the allowed list for this policy.
public void ClearCipherSuites()
Removes all cipher suites from the allowed list for this policy, effectively disabling all cipher suites until new ones are added.
public bool Remove(TlsCipherSuite cipherSuite)
TlsCipherSuite to remove from the allowed list.bool: true if the cipher suite was successfully removed; otherwise, false.
Removes a specific cipher suite from the allowed list for this policy.
The CipherSuitesPolicy class is crucial for enhancing the security of your network applications by allowing you to precisely control the cryptographic algorithms used in TLS/SSL connections. By default, systems might support a wide range of cipher suites, some of which could be considered less secure or vulnerable to known attacks.
CipherSuitesPolicy enables you to enforce stronger security standards by only allowing modern, cryptographically sound cipher suites. This can help protect against man-in-the-middle attacks, eavesdropping, and other security threats.
CipherSuitesPolicy and then assign it to the Ssl/TlsProtocols setting (or similar property) of your network client or server implementation.
The following example demonstrates how to create a CipherSuitesPolicy that only allows TLS 1.2 and TLS 1.3 with specific, strong cipher suites.
using System;
using System.Net.Security;
using System.Collections.Generic;
public class Example
{
public static void Main(string[] args)
{
// Create a new CipherSuitesPolicy
var policy = new CipherSuitesPolicy();
// Define a list of desired strong cipher suites (example for TLS 1.2/1.3)
// You should consult current best practices for the most up-to-date list.
var strongCipherSuites = new List<TlsCipherSuite>
{
TlsCipherSuite.Tls13_Aes128GcmSha256,
TlsCipherSuite.Tls13_Aes256GcmSha384,
TlsCipherSuite.Tls12_DheAes128GcmSha256,
TlsCipherSuite.Tls12_DheAes256GcmSha384,
TlsCipherSuite.Tls12_EcDheAes128GcmSha256,
TlsCipherSuite.Tls12_EcDheAes256GcmSha384,
TlsCipherSuite.Tls12_EcdheP256Aes128Sha256,
TlsCipherSuite.Tls12_EcdheP256Aes256Sha384,
TlsCipherSuite.Tls12_EcdheP384Aes256Sha384
};
// Add the strong cipher suites to the policy
policy.AddRange(strongCipherSuites);
// You can also clear and add individually
// policy.ClearCipherSuites();
// policy.Add(TlsCipherSuite.Tls13_Aes256GcmSha384);
Console.WriteLine("CipherSuitesPolicy configured with specific strong cipher suites.");
Console.WriteLine("Allowed Cipher Suites:");
foreach (var suite in policy.AllowedCipherSuites)
{
Console.WriteLine($"- {suite}");
}
// In a real application, you would use this policy with an SslClientAuthenticationOptions
// or SslServerAuthenticationOptions.
// For example (client-side):
/*
var clientOptions = new SslClientAuthenticationOptions
{
CipherSuitesPolicy = policy,
TargetHost = "example.com",
CertificateRevocationCheckMode = X509RevocationMode.Online
};
// Then use clientOptions with an SslStream
*/
}
}