I have a question related to the cipher suite TLS_DHE_RSA_WITH_AES_256_CBC_SHA
(0x0039).
It is first mentioned in RFC3268 in 2002. The highest available TLS version in 2002 was TLS 1.0 (RFC 2246). Thus RFC3268 was an extention which provided new cipher suites to TLS 1.0. The mentioned cipher suite is also listed in RFC4346 (TLS 1.1) and RFC5246 (TLS 1.2).
I was running different tools to check the cipher suite. First openssl s_client
:
$ openssl s_client -cipher DHE-RSA-AES256-SHA -connect www.uni-luebeck.de:443
...
Protocol : TLSv1.2
Cipher : DHE-RSA-AES256-SHA
...
And with nmap:
nmap --script ssl-enum-ciphers -p 443 www.uni-luebeck.de | grep "ciphers\|TLSv\|TLS_DHE_RSA_WITH_AES_256_CBC_SHA"
| ssl-enum-ciphers:
| SSLv3: No supported ciphers found
| TLSv1.0:
| ciphers:
| TLS_DHE_RSA_WITH_AES_256_CBC_SHA - strong
| TLSv1.1:
| ciphers:
| TLS_DHE_RSA_WITH_AES_256_CBC_SHA - strong
| TLSv1.2:
| ciphers:
| TLS_DHE_RSA_WITH_AES_256_CBC_SHA - strong
Checking the same cipher suite with openssl ciphers
returns SSLv3, which seems wrong to me:
$ openssl ciphers -V | grep 0x39
0x00,0x39 - DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1
openssl ciphers
, and not TLSv1?