1

We moved to RC4-MD5 as a mitigation to BEAST attack. But our other teams are saying to use DES-CBC3-SHA

I want to know if DES-CBC3-SHA is also equivalent secure and mitigates BEAST as well ?

Also are the browser compliance different for these ciphers ?

closed as unclear what you're asking by Eric G, Iszi, TildalWave, Steve, AJ Henderson May 7 '14 at 13:25

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Take a look at Mozilla's recommended ciphersuite. None of the ciphers you list is recommended. BEAST is mitigated by upgrading to at least TLS 1.1. – Stephen Touset May 6 '14 at 0:54
2

DES-CBC3-SHA is affected by BEAST, but it might still be a better choice than RC4-MD5, because BEAST is considered mostly fixed on the client side while it gets easier every day to crack RC4. See also https://community.qualys.com/blogs/securitylabs/2013/09/10/is-beast-still-a-threat. The best is of course to move to TLS1.1 or higher, but not all clients can do this.

Not the answer you're looking for? Browse other questions tagged or ask your own question.