7

I'd like to know how safe the TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA Cipher (Cipher ID: [0xc009]) is. Alternatively, I'd appreciate to be directed to some sort of list that lists all available Cipher Suites from strongest to weakest.

1 Answer 1

9

It is safe, but not ideal. Let's break it up into its individual components:

  • ECDHE - This is the key exchange mechanism. It is diffie-hellman key exchange using an elliptic curve, typically a NIST curve such as P-256. It provides forward secrecy, because each key exchange uses a different, randomly generated private key.

  • ECDSA - This is the algorithm used to sign the certificate. Like DSA, each signature requires high-quality random numbers. The failure of the RNG during even one signature can reveal the private key. This makes it rather fragile, but when used correctly, it is secure. The alternative is RSA which is the industry standard, but uses bulkier keys and signatures.

  • AES_128 - The symmetric cipher is 128-bit AES, a secure block cipher and the NIST standard. Virtually all TLS connections use AES. Most key exchange algorithms do not provide much more than 128 bits of security anyway, so there is little reason to use a larger key size.

  • CBC - Block ciphers require a mode of operation, and CBC is one of them. While it is fine in theory, it is notoriously easy to get wrong and has been the source of numerous padding vulnerabilities in the past. Any modern version of TLS should not be vulnerable to these, even with CBC. CBC is an unauthenticated mode, which brings us to...

  • SHA - An HMAC, a type of keyed hash, is used to provide integrity. It is given a secret key which allows each side of the connection to verify that the data has not been tampered with in transit. In this cipher suite, SHA-1 is the algorithm used with HMAC. While SHA-1 has been found vulnerable to a collision attack, that is not relevant for its use in HMAC.

Rather than just using this one cipher suite, why not follow best practices?

5
  • So, according to how you broke this down, CBC is actually the weakest part of the Cipher Suite? With AES_128 being not ideal but by far good enough, SHA being vulnerable, but without potential of that vulnerability being exploited and ECDHE and ECDSA being state-of-the-art. Did I summarize that correctly? Jun 5, 2018 at 2:28
  • @UmBottesWillen Correct. CBC should be replaced with an authenticated mode like GCM. A list of good modes is described in the final link regarding TLS best-practices.
    – forest
    Jun 5, 2018 at 2:40
  • Ok, got it. Thanks very much for your detailed answer! Jun 5, 2018 at 3:03
  • "forward secrecy" means that you cannot decrypt a recorded session, even if you have the private key. It does not specify a mechanism by which this can be achieved.
    – OrangeDog
    Jun 5, 2018 at 12:26
  • @OrangeDog Good point. I've changed the wording now.
    – forest
    Jun 6, 2018 at 1:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.