13

Does standard AES with RSA (reported by Opera as TLS v1.0 256 bit AES (1024 bit RSA/SHA)) provide perfect forward secrecy?

Which SSL3.0 and TLS1.0 ciphers do provide forward secrecy?

Which ciphers in openssl provide forward secrecy and are regarded as secure?

Improve this question
1
  • 1
    Those cipher suites have DHE or ECDHE in their names.
    – Smit Johnth
    Apr 19, 2018 at 16:39

2 Answers 2

Reset to default
16

Cipher suites which provide perfect forward secrecy are those which use a Diffie-Hellman key exchanged, signed by the server -- but the server key may be of type RSA. Consider the TLS standard: there are two cipher suites which use AES with a 256-bit key, SHA-1 for integrity check, and a RSA server key:

  • TLS_RSA_WITH_AES_256_CBC_SHA
  • TLS_DHE_RSA_WITH_AES_256_CBC_SHA

Only the latter provides perfect forward secrecy. In the former, the key exchange is done by encrypting a random value with the RSA server keys, something which can be unraveled later on by an attacker who could steal a copy of the server private key.

Information provided by Opera does not seem to be sufficient to distinguish between those two cipher suites.

Improve this answer
13
  • 2
    Note, apart from standard DHE suites there are also the elliptic curve versions named [...]_ECDHE_[...]. Opera might not give you all the information but maybe it allows to disable the ciphersuites without forward secrecy. According to Google you can do that in Tools \ Preferences \ Advanced Tab \ Security Item \ Security Protocols \ Details. It is possible that some SSL sites do not work anymore after this, but to my knowledge DHE is very common.
    – pepe
    Jul 19, 2011 at 23:23
  • 3
    Opera does distinguish between them, DH versions are reported as TLS v1.0 256 bit AES (1024 bit DHE_RSA/SHA)
    – Hubert Kario
    Jul 20, 2011 at 4:55
  • @pepe: I'm more interested in making sure that my server provides only ciphers with perfect forward secrecy
    – Hubert Kario
    Jul 20, 2011 at 4:57
  • 2
    @Hubert: in TLS, the client announces what cipher suites it supports (ordered list: preferred client suite comes first), and then the server chooses the cipher suite that will be used. Normally, the suites that the server will use can be configured (it depends on the server TLS implementation). Also, traditionally, the server follows the client order of preference, but, then again, some servers may be configured to enforce their order of preference.
    – Thomas Pornin
    Jul 20, 2011 at 12:14
  • 1
    @Hubert: If you have to use Windows for accessing the Internet, try using a version that is not 10 years old. MS implemented significant structural security advances since XP.
    – pepe
    Aug 13, 2011 at 23:33
3

In addition to the traditional Diffie-Hellman cipher suites you can also use those based on Elliptic Curve DH key exchange, they provide Perfect Forward Secrecy as well.

Suitable ciphers are listed in RFC4492.

Improve this answer
9
  • Curious why this was downvoted? Is it wrong that EC can provide PFS?
    – AviD ♦
    Jul 21, 2011 at 9:10
  • @AviD: Wondering too. No, it's the DH in ECDH that provides the same goodies that DH does, PFS being one of them.
    – emboss
    Jul 21, 2011 at 10:08
  • 1
    @emboss: ECDH is using elliptic curves, EDH is using modulo arithmetic multiplicative group of integers. They achieve the same result (forward secrecy) but using slightly different methods. In effect, ECDH is fast, EDH is not. This difference alone warrants voting up this answer. (And the previous comment was supposed to be an answer to @AndreyBotalov)
    – Hubert Kario
    Jun 11, 2012 at 0:13
  • 1
    "The ECDHE_ECDSA and ECDHE_RSA key exchange algorithms provide forward secrecy protection in the event of server key compromise, while ECDH_ECDSA and ECDH_RSA do not." This answer doesn't mention that and says about ECDH in general.
    – Andrei Botalov
    Jun 11, 2012 at 10:36
  • 1
    @HebertKario "No, it's the DH in ECDH that provides the same goodies that DH does" is also incorrect. Either DHE or ECDHE is needed. DH and ECDH don't provide forward secrecy
    – Andrei Botalov
    Jun 11, 2012 at 10:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .