Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

There are a lot of cipher suites defined in the in the specifications itself of TLS 1.0, 1.1 and 1.2. And furthermore, there exist RFCs which add even more cipher suites to a specific version (e.g. RFC 4492 for ECC or RFC 4132 for Camelia).

Is there an official organization like for example NIST or BSI Germany that has a list which cipher suites are considered to be safe? Or are all cipher suites offered by a specific TLS version safe to use?

share|improve this question
add comment

1 Answer

You might want to have a look at RFC 6460 (thanks to Jumbogram for highlighting the new RFC).

There are also some lists of known weak ciphersuites to avoid. You can find some guidelines on testing those from OWASP

and recently there's a little bit of a humdrum going on about BEAST, including several posts on stackexchange... here's one of my favourites :)

share|improve this answer
RFC 5430 has been replaced by 6460: tools.ietf.org/rfc/rfc6460.txt –  Jumbogram Feb 7 '12 at 13:27
Thanks @Jumbogram. Good to know! –  Yoav Aner Feb 7 '12 at 15:02
I've updated the answer with the latest RFC –  Yoav Aner Feb 27 '12 at 10:01
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.