We moved to RC4-MD5 as a mitigation to BEAST attack. But our other teams are saying to use DES-CBC3-SHA

I want to know if DES-CBC3-SHA is also equivalent secure and mitigates BEAST as well ?

Also are the browser compliance different for these ciphers ?

  • 1
    Take a look at Mozilla's recommended ciphersuite. None of the ciphers you list is recommended. BEAST is mitigated by upgrading to at least TLS 1.1. – Stephen Touset May 6 '14 at 0:54

DES-CBC3-SHA is affected by BEAST, but it might still be a better choice than RC4-MD5, because BEAST is considered mostly fixed on the client side while it gets easier every day to crack RC4. See also https://community.qualys.com/blogs/securitylabs/2013/09/10/is-beast-still-a-threat. The best is of course to move to TLS1.1 or higher, but not all clients can do this.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.