10

I am hardening the configuration for my /etc/ssh/sshd_config and have a few choices for Ciphers:

aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,
aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,
aes256-cbc,arcfour

Of these, there are some I know not to use, such as arcfour. Beyond that, I often have to search forums and blog posts to find out if a particular cipher suite is still strong. Sometimes this information can be out of date or inaccurate. I have a tough time trusting it.

Is there a reference or website that keeps up to date information on the relative strength of each cipher suite? Ideally, I'd like to know the current situation for both SSH and TLS settings. Also, is there any service that will notify you when the list changes (with the addition of a new cipher suite or the degradation of an old one).

Assuming I'm willing and able to upgrade at any point, I'd like to use the strongest and most secure settings available.

4

Many countries publish Security standards for cipher suited.

In US, you can rely on pci dss standard, fips 140-2, ANSI, EAL, etc.

In France we have the RGS which indicate the algorithms and key length which can be trusted and how many time we can rely on.
I guess every industrialized country has the same standard.

I personally choose to follow this website: https://cipherli.st/ It gathers best Security practices from many sources.

|improve this answer|||||
3

Most vendors using SSL/TLS commonly use OpenSSL who keeps a detailed record of vulnerabilities associated with SSL/TLS. Subscribing to security sites like Bugtraq will keep you in the loop regarding disclosed (known) vulnerabilities associated with OpenSSL and may tell you about the other SSL libraries as well. You would also want to subscribe to other security mailing lists associated with a product. E.g., Microsoft security, Red Hat, etc.

|improve this answer|||||
2

If you want information about the estimated strength of the ciphers, I still recommend the 2013 ENISA report. I don't know of any constantly updated list, but the only way the assumptions in that report can change is if some cipher is broken (in the cryptographic sense, not necessary relevant in practice), and that will be widely reported, if it is made public.

If you want to know the best-practices to configure your server(s), I recommend BetterCrypto.org. They have a draft paper on how to configure the most common software and some explanations. They hopefully will update the draft soon. Also take a look at cipherli.st like Sibwara suggested.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.