How can I determine the encryption strength of an SSL connection

Question

If I've connected to a https url, how can I determine the cipher strength of the connection? My understanding is that after the asymmetric public-key handshake the information is encrypted using a symmetric key with a given strength but I can't seem to find that number (128-bit etc).

Please let me know if I am misunderstanding something with the process too.

Edit: The reason I ask is that I have a template for a security disclaimer that contains a statment This website uses XX-bit encryption and I'd like to fill that with the correct number.

Answer 1

The SSL symetric encryption is the result of a negotiation between client and server. It is possible to restrict it from the server side by using the configuration files. For example, apache SSL configuration include a

SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL

That can be tune to accept only the strongest encryptions, for example you may want to require only :

SSLProtocol all -SSLv2
SSLCipherSuite HIGH:MEDIUM

Other variables can be used to do more things like client authentication or require per-directory ciphers.

You can also manipulate the negotiation from the client side. As for an example, please refer to this link that is talking a bit about Firefox SSL settings tuning. I assume other browsers have ways to do this as well.

It seems as this page says that :

The server decides upon the list of cryptography and compression algorithms sent by the client whether to continue or cancel the session. There must be at least one match in both lists, otherwise the session will fail. The cipher combination which took the highest place in the client's list will be used for future communication.

I'm looking for the official protocol.

Answer 2

SSL includes a feature known as "ciphersuite negotiation". The client presents a list of ciphersuites that it is willing to use, and the server selects its favorite from that list. Although you may test your website using your copy of some browser, someone else might be using a different browser with a different configuration and your website may use a weaker ciphersuite for that person.

You should check the documentation for your web server to understand how to configure your web server to use only those ciphersuites that meet your needs.

Answer 3

SSL Labs have a SSL Server Test tool on their site which will test an SSL-enabled site and provide valuable information about its security (such as key length), including known vulnerabilities particular to the configuration.

Answer 4

Hmm there are number of tools that you can use. On a Linux system:

Initiate a single SSL connection to the website via the browser etc....

Enter the command :

ssldump -i eht1 -p 80

This will elucidate the SSL handshake to the webserver (by dumping SSL traffic on the specific interface). The dump shows the cipher suite used.

Look for this : cipherSuite TLS_RSA_WITH_RC4_128_SHA

Answer 5

If you are using Chrome, and maybe Firefox, you can click on stuff to the left of https://xxx in the URL bar and check it. It will tell you which cipher suite was selected (like RC4 or AES), and the size of the key used.

I'm using Safari at the moment (new MacBook Air), and I don't immediately see how to do this. Clicking on the lock icon in the upper right only shows me the certificate, but not the strength of the current connection.

The other way of doing this is with a packet sniffer -- the very thing SSL is supposed to protect against. The first few packets, where they negotiate the encryption algorithm and strength, are unencrypted. You can see from them which strength they've chosen for a connection.

Answer 6

I just wanted to add to the answers above that the only way to get the result you need is to have the server not do negotiation or do but using only some ciphers of the same length.

For example, in apache, you could add

SSLRequire %{SSL_CIPHER_USEKEYSIZE} = 256

to only accept 256 key size.

But be careful, as this will probably lead to clients not being able to connect if they don't offer a cipher suite allowed by the server. If you go down this path you should monitor the ssl negotiation errors at the server for some time to make estimates.

Answer 7

Clientside:

For Firefox there is an extension: https://addons.mozilla.org/en-US/firefox/addon/cipherfox/

Right-click and selecting "View Page Info" works too.

Serverside:

see How can I determine the encryption strength of an SSL connection