I went through various online docs, e.g. SSL and TLS Deployment Best Practices, regarding the "right" selection of cipher suites for a website. The attached picture shows my selection of cipher suites with lower priority from top to bottom, e.g. ECDHE-ECDSA-CHACHA20-POLY1305 has the highest priority. In the following, I explain this selection and I would like to have your feedback.
I got the ciphers with the following command, provided by LibreSSL 2.4.1:
openssl ciphers -v | grep -i dhe | grep -i -e ecdsa -e rsa | grep -i -v camellia | grep -i -v rc4 | grep -i -v 3des | grep -i -v ChaCha20-Poly1305-Old
My reasons for the selection:
- dhe: allow only ciphers that support forward secrecy
- ecdsa/rsa: disable weak DSA/DSS ciphers
- camellia: Not as much tested as AES?!? Patent!
- rc4: weak
- 3des: weak
- ChaCha20-Poly1305-Old: draft cipher
Thereafter, I sorted the ciphers with security in mind:
- I first chose ciphers supporting AEAD due to among others:
"You should rely chiefly on the AEAD suites ..." (SSLLABS best practices)
- Then, ECDSA ciphers are favoured over RSA. RSA1024 is weak, RSA2048 is all right for now, but RSA3072 and higher puts too much load on the server (IMHO).
- ECDH is favoured. DH with 2048 Bit and above is secure for now. But, vulnerabilites are known for lower key lengths. On the other hand, secp256r1 (NIST P-256), which is the most widely supported ECC, is insecure according to Bernstein (URL: safecurves.cr.yp.to). Furthermore secp256r1 comes from NIST! What do you think? Use DH with known vulnerabilities for short key lengths or ECDH with secp256r1 coming from NIST and being insecure according to Bernstein?
After making my selection based on the cipher's strength, I further prioritized based on the performance.
- First, I made my selection based on the encryption algorithm with the assumption that it has a bigger impact on performance than the chosen hash algorithm. Am I right or wrong?
- With PCs and Laptops being generally more performant than mobile devices, I put the focus on mobile devices and chose ChaCha20-based ciphers first, that run on ARM-based mobile devices faster than AES due to missing AES-NI support (URL: blog.cloudflare.com/do-the-chacha-better-mobile-performance-with-cryptography/). Modern PCs on the other hand have AES-NI support und run faster with AES.
- The further choices (AES128 over AES256 and SHA1->SHA256->SHA384) are self-explanatory. HMAC-SHA1 doesn't pose a risk AFAIK. Or am I wrong?
Btw, I don't mind connectivity issues with Windows XP and some other old systems. ECDSA and RSA will be available on my webserver simultaneously. Nginx supports multiple certs starting with version 1.11.0, while Apache supports it for a longer time. I am going to use the cleaner LibreSSL, which already has ChaCha20.