title: Which Cipher Suites to enable for SSL Socket?
body: <p>I'm using Java's SSLSocket to secure communications between a client and a server program. The server program also serves up HTTPS requests from web browsers.</p>
  
  <p>According to "<a href="http://www.wrox.com/WileyCDA/WroxTitle/productCd-0764596330.html" rel="noreferrer">Beginning Cryptography with Java</a>", page 371, you should always call <code>setEnabledCipherSuites</code> on your <code>SSLSocket</code> / <code>SSLServerSocket</code> to ensure that the cipher suite that ends up being negotiated is sufficiently strong for your purposes.</p>
  
  <p>That being said, a call to my <code>SSLSocketFactory</code>'s <code>getDefaultCipherSuites</code> method yields some <em>180</em> options. These options range from <code>TLS_RSA_WITH_AES_256_CBC_SHA</code> (which I think is fairly secure) to <code>SSL_RSA_WITH_RC4_128_MD5</code> (not so sure if that's secure, given MD5's current status) to <code>SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA</code> (not entirely sure what that does).</p>
  
  <p><strong>What's a sensible list of cipher suites to restrict the sockets to?</strong></p>
  
  <p>Note that the client and server have access to the <a href="http://www.bouncycastle.org/" rel="noreferrer">Bouncy Castle</a> service provider, and that they may or may not have unlimited cryptographic policy files installed.</p>