Qualys SSL Labs says that my server is announcing OLD_TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 as my first cipher-suite. I confess that I enabled Poly1305 because Google thinks is cool, not because I'm particularly cunning in cryptography matters. And now it says it is "Old"! Why is it "old"? Is there any risk lurking there?

As a side note, the server is running in its default TLS configuration, which I would like to change if there is anything flawed.


Back in the day when the ChaCha20-Poly1305 cipher suites were introduced, Google rushed them out. There was no full IETF TLS WG review nor was there any formal process involved (which isn't yet finished as of 10th march 2016). However the draft for the cipher suites was brought up and was adapted over time.

Part of this progress is the formal assignment of "code points" (i.e. the bytes identifying the cipher suites), which was done only quite recently (around 1st march 2016) by IANA. The assigned code point for your cipher suite is 0xCC,0xA8. Here is where the "old" comes into play. Your server advertises support for 0xCC,0x13 which is a different code point. To distinguish the code points Qualy's apparently added the OLD_ as prefix.

Additionally it may be the case that the TLS WG changed some things compared to the original ChaCha20-Poly1305 cipher suites (like nonce generation) which also require a different code point to avoid confusion by implementations which (still) implement the "old" suite.

Is there any risk lurking there?

No. The old cipher suites are still good and will be for quite some time, you can however expect support by browser to be dropped "soon" for those cipher suites (within a few years maybe).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.