Tag Info

New answers tagged

1

for best compatibility the cloudflare-cipher-suite is not the best; i found the following better: # suggestion from sslabs / including PFS, good compatibility #ssl_ciphers ...


2

First, let's go over how cipher suite negotiation works, very briefly. For example, we can use the TLS 1.2 document RFC 5246 starting at section 7.4.1.2 to see, in the short short form: ClientHello: The client tells the server which cipher suites the client supports Now the server picks one I'll discuss how to control which one it picks next! ...


2

OpenSSL naturally will prefer newer MACs for otherwise-equivalent cipher suites. For example, the lengthy openssl ciphers -v output for your cipher string starts with: ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(256) Mac=AEAD ...


0

Choice of hash function (SHA-1 vs SHA-256) does not really depend on the cipher suite, but on the protocol version. Basically, you get SHA-256 if you use TLS 1.2, SHA-1 if you use an older version. (Yes, I known this is a simplified description of a slightly more complex situation, but here it works.) Normally, client and server will use the highest ...


1

The blog post at Portcullis security seems to be saying that you have to hash the 12-byte "salt" with SHA1 to turn it into a 20-byte string before prepending it to the hashed password.



Top 50 recent answers are included