I have a question related to the cipher suite
It is first mentioned in RFC3268 in 2002. The highest available TLS version in 2002 was TLS 1.0 (RFC 2246). Thus RFC3268 was an extention which provided new cipher suites to TLS 1.0. The mentioned cipher suite is also listed in RFC4346 (TLS 1.1) and RFC5246 (TLS 1.2).
I was running different tools to check the cipher suite. First
$ openssl s_client -cipher DHE-RSA-AES256-SHA -connect www.uni-luebeck.de:443 ... Protocol : TLSv1.2 Cipher : DHE-RSA-AES256-SHA ...
And with nmap:
nmap --script ssl-enum-ciphers -p 443 www.uni-luebeck.de | grep "ciphers\|TLSv\|TLS_DHE_RSA_WITH_AES_256_CBC_SHA" | ssl-enum-ciphers: | SSLv3: No supported ciphers found | TLSv1.0: | ciphers: | TLS_DHE_RSA_WITH_AES_256_CBC_SHA - strong | TLSv1.1: | ciphers: | TLS_DHE_RSA_WITH_AES_256_CBC_SHA - strong | TLSv1.2: | ciphers: | TLS_DHE_RSA_WITH_AES_256_CBC_SHA - strong
Checking the same cipher suite with
openssl ciphers returns SSLv3, which seems wrong to me:
$ openssl ciphers -V | grep 0x39 0x00,0x39 - DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1