I know "SSL 3.0" and TLS 1.0 have weakness security, because using of "RC4" cipher. instead it, "TLS 1.2" have more security, now I want to use of a fast ciphersuite and a complicated handeshake method in "TLS" (for prevent of Man in the Middle Attacks).

It seems to me , key-exchange and ciphersuite methods should be as follows (priority respectively) :


Now, which of Ciphersuites are fast and more secure in "TLS" handshaking?

  • DHE key exchange is very slow compared to ECDHE, so you should prefer the ECDHE ciphers.
  • ECDSA is faster than RSA for the same level of security, but of course you need a ECDSA certificate and not a RSA certificate in this case.
  • AES-GCM is faster than ChaCha20-Poly1305 on systems with hardware support for AES but slower on systems without hardware support. You usually have hardware support on desktop system but it is missing on most mobile phones or tablets.
  • CAMELLIA seems to be in theory similar to AES regarding security and performance but usually lacks hardware support and is thus slower. See Why does nobody use (or break) the Camellia Cipher? for more information.
  • "but it is missing on most mobile phones or tablets" - is this actually true on modern mobile platforms? I was under the impression that most mobile ARM cores had hardware AES acceleration support via the "Security System" instruction set. – Polynomial Jul 12 '16 at 12:01
  • @Polynomial: ARMv8 64bit got hardware support for AES but this is not yet the major architecture you will find in the mobile phones currently in use. See also calomel.org/aesni_ssl_performance.html, blog.cloudflare.com/… and bugs.chromium.org/p/chromium/issues/detail?id=585566 for some more information. – Steffen Ullrich Jul 12 '16 at 13:09
  • suppose i want to send data to a system in far way(consider long distance and tls latency and overhead, and trusted authentication), so, should i use of ECDSA or ECDHE? – BattleTested Jul 13 '16 at 4:16
  • @MohammadrezaPanahi: ECDSA (vs. RSA) addresses authentication while ECDHE (vs. DHE) addresses key exchange. Thus there is no "ECDSA or ECDHE" because these address different types of the handshake. You can use ECDSA+ECDHE but also RSA+ECDHE etc. Apart from that - if you care about latency on long distance connections all solutions perform about the same because the problem in this case is not the computational overhead but the speed and latency of packet transfer which depends on the line characteristics and not the crypto. – Steffen Ullrich Jul 13 '16 at 5:08
  • most importantly, is handshake security! i thing must choose a complicated method for this. what is your offer about it? – BattleTested Jul 13 '16 at 6:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.