4

Is there anything against this TLS-configuration in Apache:

SSLProtocol TLSv1.2
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256

There are lots of examples that use a more complicated setup, but I believe this configuration is both secure and easy to understand.

We expect our users to have a fairly recent browser or device, so we don't have to (or even want to) support Android 4.3 or IE 7.

  • Checking the Apache logs I found some IE 11/Windows 7 users that are unable to use AES_GCM or CHACHA20, so I had to enable an AES_CBC cipher. My config now looks like this: ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256 – Gert-Jan Nov 22 '18 at 12:49
2

There are no known vulnerabilities in TLS 1.2 or that cipher suite. If it works for you from a compatibility and performance standpoint, it's fine to use.

  • 1
    +1 This is the correct answer. My rule of thumb is that any subset of the Mozilla Modern list is fine from a security perspective, and since the cipher suite mentioned in on that list, you're good! – Mike Ounsworth Nov 16 '18 at 14:22
  • That's great, so I will stick with this simple config. Polynomial advises to add ChaCha20 for better performance but I would first like to know if this really makes a difference. – Gert-Jan Nov 16 '18 at 15:38
1

This configuration is fine, although I recommend also offering one of the ChaCha20-Poly1305 suites and making that suite the preferred option. I would suggest that you offer TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 if you are using RSA certificates, or TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 if you are using ECDSA certificates.

The reason for this is performance. AES-GCM uses some operations that are not fast without hardware acceleration. Specifically, the AES instruction set extension and carryless multiplication (e.g. PCLMULQDQ, XMULX) are used to perform the block cipher encryption and carryless multiplication over GF(2k) for GHASH respectively. Without these extensions the performance of AES-GCM is particularly poor. This primarily affects smartphones which may have AES extensions (only on ARMv8 architecutres) but will not provide the necessary carryless multiply extensions.

ChaCha20-Poly1305, however, relies only upon SIMD instructions for performance. These are fairly ubiquitous. All modern x86_64 processors and most high-end ARM processors offer a range of SIMD instruction extensions (e.g. SSE4, AVX2, NEON, etc.) which can enable highly efficient and performant implementations of ChaCha20-Poly1305.

Additionally, referencing back to my mention of ECDSA certificates, you may want to consider them instead of traditional RSA certificates. All modern browsers support such certificates and they, again, offer improved performance. ECDSA is also considered to be more future-proof against new attacks and is generally more straightforward from a security perspective (RSA has a lot of problems you have to mitigate when writing an implementation). If you do choose ECDSA certificates, you'll need to swap your existing configuration to use TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 for GCM.

  • I will look into the ChaCha20 option. Would you really notice a difference on a cheap Android phone? – Gert-Jan Nov 16 '18 at 15:35
  • @Gert-Jan Low performance means high power usage. It wouldn't be a vast difference but it's worth considering. The performance difference between RSA and ECDSA is probably the most noticeable. Additionally there are some concerns about AES-GCM being fragile from a cryptographic standpoint (seems to mostly focus on the difficulty of creating a secure implementation rather than the strength of the cryptography itself) but I don't sufficiently understand the problems to provide details on that front. – Polynomial Nov 16 '18 at 16:00
  • With the current certificate DSA is not an option, but I will add the ChaCha20 cipher to my configuration. Thanks for the update! – Gert-Jan Nov 17 '18 at 9:20
  • It turns out that none of the clients would use ChaCha20 if my server had AES as the preferred cipher. So I ended up putting ChaCha first and AES second. – Gert-Jan Nov 19 '18 at 22:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.