8

A company have made a vulnerability scan and give us a report that, recommends to use TLS 1.2 and enable only AEAD ciphers suite, but they aren't giving more information about what I need to achieve this.

I haven't found the list of this ciphers suites, that are compliant with this requirement. Also want to know if there is way to identify, with the name of the suit if a suite is compatible with AEAD.

9

Don't do this. At least, don't do this on any system where you don't know for sure that it's not going to break things.

AEAD stands for "Authenticated Encryption with Additional Data" meaning there is a built-in message authentication code for integrity checking both the ciphertext and optionally additional authenticated (but unencrypted) data, and the only AEAD cipher suites in TLS are those using the AES-GCM and ChaCha20-Poly1305 algorithms, and they are indeed only supported in TLS 1.2. This means that if you have any clients trying to connect to this system that don't support either TLS 1.2, or even those that do support TLS 1.2 but not those specific cipher suites (and they're not mandatory...Only TLS_RSA_WITH_AES_128_CBC_SHA is mandatory, and it isn't an AEAD cipher suite) then those clients will not be able to connect at all.

It is true that these are the most secure options, and indeed the only options that will be supported for TLS v1.3, but for most systems today, this is not a realistic configuration. You do certainly want to enable TLS v1.2 and these cipher suites if you have an option to do so (configuring them is going to be specific to your system, so check your documentation) but as a rule, you should not require them unless you really know what you're doing and understand both your environment and the effects.

  • It is also a performance problem. With Java clients for example GCM is much slower than CBC (despite improvements to enhance GCM for JCE) – eckes Mar 19 '18 at 19:11
  • 1
    This is still good advice, but as of now (March 2018), you are not going to break anyone's (99.9999% of peoples) access to your site by requiring AEAD. See Answer from ahvm – superphonic Mar 29 '18 at 9:24
  • @superphonic We're not anywhere close to that yet, unfortunately. As of the beginning of this year, more than 10% of the connections negotiated by CloudFlare were TLS 1.0. – Xander Mar 29 '18 at 13:47
  • @Xander I'd be interested in seeing those stats... – superphonic Mar 29 '18 at 14:12
  • @superphonic blog.cloudflare.com/why-tls-1-3-isnt-in-browsers-yet – Xander Mar 29 '18 at 14:14
2

The accepted answer is a couple of years old, now, and only a select number of browsers still do not support TLS 1.2 by default and they only account for roughly ~5% of all web traffic. IE on Win XP and IE < 11 on newer versions are the biggest culprits.

This link displays a matrix of browsers that support TLS 1.2.

Chrome has supported it since version 30 (the current stable version is 64, I believe).

Windows Server 2012 R2 still doesn't support the *RSA*GCM* suites (as I recently found out trying to enable them on our web servers) so Server 2016/Windows 10 and IIS 10 will be required to use the RSA-based AEAD ciphers.

PCI compliance now requires disabling TLS 1.0, and it's only a small user base that still requires the use of TLS 1.0. So as of 2018, it is perfectly acceptable to make these changes so long as your server OS supports them.

  • This is still incorrect. Many older clients simply don't support an array of AEAD ciphersuites, and this would be a very dangerous change to make (even in mid-2018!) without proper testing to verify you aren't going to have significant client connectivity issues. – Xander May 3 '18 at 15:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.