Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Does standard AES with RSA (reported by Opera as TLS v1.0 256 bit AES (1024 bit RSA/SHA)) provide perfect forward secrecy?

Which SSL3.0 and TLS1.0 ciphers do provide forward secrecy?

Which ciphers in openssl provide forward secrecy and are regarded as secure?

share|improve this question

2 Answers 2

up vote 13 down vote accepted

Cipher suites which provide perfect forward secrecy are those which use a Diffie-Hellman key exchanged, signed by the server -- but the server key may be of type RSA. Consider the TLS standard: there are two cipher suites which use AES with a 256-bit key, SHA-1 for integrity check, and a RSA server key:

  • TLS_RSA_WITH_AES_256_CBC_SHA
  • TLS_DHE_RSA_WITH_AES_256_CBC_SHA

Only the latter provides perfect forward secrecy. In the former, the key exchange is done by encrypting a random value with the RSA server keys, something which can be unraveled later on by an attacker who could steal a copy of the server private key.

Information provided by Opera does not seem to be sufficient to distinguish between those two cipher suites.

share|improve this answer
2  
Note, apart from standard DHE suites there are also the elliptic curve versions named [...]_ECDHE_[...]. Opera might not give you all the information but maybe it allows to disable the ciphersuites without forward secrecy. According to Google you can do that in Tools \ Preferences \ Advanced Tab \ Security Item \ Security Protocols \ Details. It is possible that some SSL sites do not work anymore after this, but to my knowledge DHE is very common. –  pepe Jul 19 '11 at 23:23
3  
Opera does distinguish between them, DH versions are reported as TLS v1.0 256 bit AES (1024 bit DHE_RSA/SHA) –  Hubert Kario Jul 20 '11 at 4:55
    
@pepe: I'm more interested in making sure that my server provides only ciphers with perfect forward secrecy –  Hubert Kario Jul 20 '11 at 4:57
2  
@Hubert: in TLS, the client announces what cipher suites it supports (ordered list: preferred client suite comes first), and then the server chooses the cipher suite that will be used. Normally, the suites that the server will use can be configured (it depends on the server TLS implementation). Also, traditionally, the server follows the client order of preference, but, then again, some servers may be configured to enforce their order of preference. –  Thomas Pornin Jul 20 '11 at 12:14
1  
@Hubert: If you have to use Windows for accessing the Internet, try using a version that is not 10 years old. MS implemented significant structural security advances since XP. –  pepe Aug 13 '11 at 23:33

In addition to the traditional Diffie-Hellman cipher suites you can also use those based on Elliptic Curve DH key exchange, they provide Perfect Forward Secrecy as well.

Suitable ciphers are listed in RFC4492.

share|improve this answer
    
Curious why this was downvoted? Is it wrong that EC can provide PFS? –  AviD Jul 21 '11 at 9:10
    
@AviD: Wondering too. No, it's the DH in ECDH that provides the same goodies that DH does, PFS being one of them. –  emboss Jul 21 '11 at 10:08
1  
@emboss: ECDH is using elliptic curves, EDH is using modulo arithmetic multiplicative group of integers. They achieve the same result (forward secrecy) but using slightly different methods. In effect, ECDH is fast, EDH is not. This difference alone warrants voting up this answer. (And the previous comment was supposed to be an answer to @AndreyBotalov) –  Hubert Kario Jun 11 '12 at 0:13
1  
"The ECDHE_ECDSA and ECDHE_RSA key exchange algorithms provide forward secrecy protection in the event of server key compromise, while ECDH_ECDSA and ECDH_RSA do not." This answer doesn't mention that and says about ECDH in general. –  Andrey Botalov Jun 11 '12 at 10:36
1  
@HebertKario "No, it's the DH in ECDH that provides the same goodies that DH does" is also incorrect. Either DHE or ECDHE is needed. DH and ECDH don't provide forward secrecy –  Andrey Botalov Jun 11 '12 at 10:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.