/************************************************************************
* Brocade - Common Criteria (CC) Template for Security Crypto Configuration
*
* Desc: 
*
* Default values for security crypto configurations for CC compliance
*
*************************************************************************/

[Ver]  0.3

/*
* Group : SSH 
* Rules : Comma Separated
* Example :  aes128-ctr,aes192-ctr -> Note, no space before and after comma.
* Valid options: Kex, Mac, Enc
*/
[SSH] 
Enc:aes128-cbc,aes256-cbc
Kex:diffie-hellman-group14-sha1,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521
Mac:hmac-sha1,hmac-sha2-256,hmac-sha2-512


/*
* Group : AAA
* Rules : Textual openssl cipherlist (colon,comma and space separated)
* Example: ALL:-MD5:!PSK
* Valid options: RAD_Ciphers, LDAP_Ciphers
*/
[AAA]
RAD_Ciphers:ECDSA:ECDH:RSA:AES:!3DES:!RSAPSK:!DHEPSK:!PSK:!DSS:!ARIAGCM:!CAMELLIA:!CHACHA20:!SSLv3:!TLSv1:!AESCCM
LDAP_Ciphers:ECDSA:ECDH:RSA:AES:!3DES:!RSAPSK:!DHEPSK:!PSK:!DSS:!ARIAGCM:!CAMELLIA:!CHACHA20:!SSLv3:!TLSv1:!AESCCM
RAD_Protocol:TLSv1.2
LDAP_Protocol:TLSv1.2

/*
* Group : LOG
* Rules : Textual openssl cipherlist (colon,comma and space separated)
* Example: ALL:-MD5:!PSK
* Valid options: Ciphers
*/
[LOG]
Syslog_Ciphers:ECDSA:ECDH:RSA:AES:!3DES:!RSAPSK:!DHEPSK:!PSK:!DSS:!ARIAGCM:!CAMELLIA:!CHACHA20:!SSLv3:!TLSv1:!AESCCM
Syslog_Protocol:TLSv1.2

/*
* Group : HTTPS
* Rules : Textual openssl cipherlist (colon,comma and space separated)
* Example: ALL:-MD5:!PSK
* Valid options: Ciphers
*/
[HTTPS] 
Ciphers:ECDSA:ECDH:RSA:AES:!3DES:!RSAPSK:!DHEPSK:!PSK:!DSS:!ARIAGCM:!CAMELLIA:!CHACHA20:!SSLv3:!TLSv1:!AESCCM
Protocol:Any
Ciphers_tlsv1.3:TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:TLS_AES_128_CCM_8_SHA256:TLS_AES_128_CCM_SHA256

/*
* Group : X509v3
* Rules : Textual X509v3 validation options
* Example: Validation:Strict
* Valid options: Strict/Basic 
*/
[X509v3]
Validation:Strict

/*
* Group : Compliance
* Rules : "yes" for configuration enabled and "no" for disabled. For SelfTests, all or default or required self test name can be provided. Also, note that CryptoVersion is a read-only attribute.
* Example: "yes" OR "no". For SelfTests, following tests are supported if 'all' is provided, or required self test name can be provided from these supported tests as well: 
* DH, DRBG, AES, AES_GCM, AES_CCM, RSA, RSA2048_SHA256, DES, DSA, SHA1, SHA256, SHA384, SHA512, HMAC_SHA1, HMAC_SHA224, HMAC_SHA256, HMAC_SHA384, HMAC_SHA512, SHA3, ECDSA, ECDH
* Also, following SelfTests are supported if 'default' is provided: AES, AES_GCM, AES_CCM, RSA, SHA512, HMAC_SHA512, ECDSA
* Valid options: BootUpSelfTests, SelfTests, Zeroize, FIPSInside, CryptoIntegrityTest, FIPSExtn
*/
[Compliance]
BootUpSelfTests:yes
Zeroize:no
FIPSInside:no
SelfTests:default
CryptoIntegrityTest:yes
FIPSExtn:no
