Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In RFC 4347 for DTLS, I am unable to find the cipher list to be supported. The RFC mentions it as a set of changes from TLS 1.1 (RFC 4346). TLS 1.1 prohibits use of export ciphers.

Are export ciphers disallowed in DTLS also? How to confirm?

share|improve this question
up vote 3 down vote accepted

Section 4 of RFC 4347 begins with this text:

As mentioned in Section 3, DTLS is intentionally very similar to TLS. Therefore, instead of presenting DTLS as a new protocol, we present it as a series of deltas from TLS 1.1 [TLS11]. Where we do not explicitly call out differences, DTLS is the same as in [TLS11].

That's reasonably explicit: anything which is not described in RFC 4347, must be done as it is done in TLS 1.1. TLS 1.1 explicitly rejects support of "export" cipher suites, so DTLS does not support them either.

The RFC is like the US Supreme Court: it recognizes no power above itself. There is no "reference implementation" which would define what is supported and what is not. So there is nothing to "confirm", in a legalistic way. A weaker but more practical notion of "support" is interoperability: do existing implementations of DTLS try to support the so-called "export" cipher suites ? It seems that OpenSSL does support it:

(on the server)
$ openssl s_server -dtls1 -cipher EXP-EDH-DSS-DES-CBC-SHA
Using default temp DH parameters
Using default temp ECDH parameters

(on the client)
$ openssl s_client -dtls1     
depth=0 CN = localhost
Server public key is 1024 bit
Secure Renegotiation IS supported
Compression: zlib compression
Expansion: zlib compression
    Protocol  : DTLSv1
    Cipher    : EXP-EDH-DSS-DES-CBC-SHA

However, there is very little reason to use these cipher suites nowadays; they were meant to comply to US export regulations (hence the name), and the restrictions on key size have been mostly lifted a dozen years ago. No SSL/TLS implementation enables them by default, and servers which are actually configured to accept them should be exceedingly rare. If you are implementing your own DTLS code, you would not be blamed for omitting them, especially since the wording of the RFC implies that they are forbidden.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.