7

I have not found a straight forward way to determine where a given cipher list supports PFS or not. For instance, how can I use output of:

$ openssl ciphers -v aECDSA:aECDH:kEDH:kRSA

to determine if any of the configurations supports (non) PFS based communication?

1 Answer 1

6

Perfect Forward Secrecy is obtained by using Ephemeral Diffie-Hellman keys (DHE or ECDHE). So to get the cipher suites in that list that support PFS you could do:

$ openssl ciphers -v aECDSA:aECDH:kEDH:kRSA | grep DHE

This will include ciphers based on ECDHE (Elliptic Curve) as well as DHE (RSA). An advantage of ECDHE is that it is a lot faster than DHE. However in the list generated by that command there are still quite a few weak ciphers that use weak or no crypto: DES, RC4, SSLv3, NULL.

All of those happened to have SSLv3 in common, so by excluding SSLv3 you get a list of 12 solid ciphers:

$ openssl ciphers -v aECDSA:aECDH:kEDH:kRSA | grep DHE |  grep -v SSLv3

ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESGCM(256) Mac=AEAD  
ECDHE-ECDSA-AES256-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AES(256)  Mac=SHA384  
ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESGCM(128) Mac=AEAD  
ECDHE-ECDSA-AES128-SHA256 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AES(128)  Mac=SHA256  
DHE-DSS-AES256-GCM-SHA384 TLSv1.2 Kx=DH       Au=DSS  Enc=AESGCM(256) Mac=AEAD  
DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH       Au=RSA  Enc=AESGCM(256) Mac=AEAD  
DHE-RSA-AES256-SHA256   TLSv1.2 Kx=DH       Au=RSA  Enc=AES(256)  Mac=SHA256  
DHE-DSS-AES256-SHA256   TLSv1.2 Kx=DH       Au=DSS  Enc=AES(256)  Mac=SHA256  
DHE-DSS-AES128-GCM-SHA256 TLSv1.2 Kx=DH       Au=DSS  Enc=AESGCM(128) Mac=AEAD  
DHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=DH       Au=RSA  Enc=AESGCM(128) Mac=AEAD  
DHE-RSA-AES128-SHA256   TLSv1.2 Kx=DH       Au=RSA  Enc=AES(128)  Mac=SHA256  
DHE-DSS-AES128-SHA256   TLSv1.2 Kx=DH       Au=DSS  Enc=AES(128)  Mac=SHA256  

Do note that you are excluding 4 PFS ciphers with your aECDSA:aECDH:kEDH:kRSA selection.

ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AESGCM(256) Mac=AEAD  
ECDHE-RSA-AES256-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AES(256)  Mac=SHA384  
ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AESGCM(128) Mac=AEAD  
ECDHE-RSA-AES128-SHA256 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AES(128)  Mac=SHA256  
1
  • aECDH does/did not exist in OpenSSL, kRSA is not PFS, and aECDSA includes some ECDHE suites but not others; kECDHE:kDHE directly gives all PFS -- including anon, which can most easily be removed by adding :!aNULL. In OpenSSL 1.0.2 when this was asked and answered the Q's spec excludes 9 ECDHE_RSA suites (the 4 you show, 2 more 'good' ones, and 3 'weak' ones, which Q didn't ask to exclude) plus 5 ECDH_anon. Since then 1.1.x in default build drops RC4 and 3DES and adds Camellia and then ARIA, making the omissions 10 or 12 and 3 respectively. Jun 25 at 1:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.