0

Scope:

I am considerable new on cryptography and only know some basic fundamentals of it.

Looking at yaSSL ciphers I am trying to, as an exercise, to figure out which ones are still safe to use by today's standards and which are not.

The problem is that, by looking at the cypher names, I am not 100% sure of what is happening / being used on each.

Examples:

  • AES128-RMD: I Suppose this one is using AES with 128 bits of key length. But what is RMD ? How does it influences encryption strength on this case?

  • DHE-RSA-AES128-RMD: I can only assume that this means that Diffie-Hellman is being used as the Asymmetric Key exchange method, followed by RSA to encrypt symmetric keys, to be used by AES-128-RMD ?

Tried to find documentation online and more about those ciphers but apparently yaSSL is the only framework that names those like this, and trying different combinations of terms isn't yielding me much.

Question:

Is there any crypto-rule-of-thumb kind of thing for refactoring these names into smaller pieces that allows us to understand the "process" behind each?

1

In general, these names are of the form "key exchange"-"authentication"-"cipher"-"hash". So, to translate your two examples:

  • AES128-RMD: This uses no authentication, out-of-band key exchange (eg. pre-shared keys), AES encryption with a 128-bit key, and RIPE-MD (probably the 160-bit variation) for message integrity checking.
  • DHE-RSA-AES128-RMD: This uses ephemeral Diffie-Hellman to exchange the symmetric key, RSA to authenticate who you're talking to, AES with a 128-bit key (the one exchanged by DHE) for encryption, and RIPE-MD for integrity checking.

And, as a third example, my connection to Sec.SE is secured with

As a more complicated example:

  • Sorry about the flood, but how about this example ? SRP-DSS-3DES-EDE-CBC-SHA Can please you include it's meaning as well ? – Marcello Grechi Lins May 16 '17 at 23:33
  • @MarcelloGrechiLins in this example, SRP is TLS-SRP, the key exchange mechanism. DSS is the signature standard being used for the key exchange (I think?), 3DES is encryption with EDE-CBC indicating the mode it is used in, SHA is the hashing algorithm – Karthik Rangarajan May 17 '17 at 0:13
1

Generally, the output of yaSSL, sslscan etc. are going to be in the following format:

<key_exchange_mechanism>-<authentication_mechanism>-<symmetric_algorithm-key_size>-<hashing_algorithm>

So in your example, DHE-RSA-AES128-RMD is Diffie-Hellman key exchange using RSA for authentication, with AES128 for symmetric encryption, and RMD for hashing. This wiki page on OpenSSL explains this process a bit.

In terms of strength - generally, you want to avoid algorithms that are broken or can be easily broken (RC4, for instance), anonymous key exchange algorithms (Anonymous Diffie-Hellman, for instance), weak symmetric algorithms (DES), and broken hashing algorithms (MD5/SHA1). You may also care about the key size, and whether the algorithm maintains Forward Secrecy or not.

  • Cool ! I seem to be on the right track. Those were the main data points I was looking at, and found the same results you suggested. For key length I am taking in account 128 bits as the bare mininum (according to NIST's reports) – Marcello Grechi Lins May 16 '17 at 21:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.