7

I have not found a straight forward way to determine where a given cipher list supports PFS or not. For instance, how can I use output of:

$ openssl ciphers -v aECDSA:aECDH:kEDH:kRSA

to determine if any of the configurations supports (non) PFS based communication?

1 Answer 1

6

Perfect Forward Secrecy is obtained by using Ephemeral Diffie-Hellman keys (DHE or ECDHE). So to get the cipher suites in that list that support PFS you could do:

$ openssl ciphers -v aECDSA:aECDH:kEDH:kRSA | grep DHE

This will include ciphers based on ECDHE (Elliptic Curve) as well as DHE (RSA). An advantage of ECDHE is that it is a lot faster than DHE. However in the list generated by that command there are still quite a few weak ciphers that use weak or no crypto: DES, RC4, SSLv3, NULL.

All of those happened to have SSLv3 in common, so by excluding SSLv3 you get a list of 12 solid ciphers:

$ openssl ciphers -v aECDSA:aECDH:kEDH:kRSA | grep DHE |  grep -v SSLv3

ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESGCM(256) Mac=AEAD  
ECDHE-ECDSA-AES256-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AES(256)  Mac=SHA384  
ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESGCM(128) Mac=AEAD  
ECDHE-ECDSA-AES128-SHA256 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AES(128)  Mac=SHA256  
DHE-DSS-AES256-GCM-SHA384 TLSv1.2 Kx=DH       Au=DSS  Enc=AESGCM(256) Mac=AEAD  
DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH       Au=RSA  Enc=AESGCM(256) Mac=AEAD  
DHE-RSA-AES256-SHA256   TLSv1.2 Kx=DH       Au=RSA  Enc=AES(256)  Mac=SHA256  
DHE-DSS-AES256-SHA256   TLSv1.2 Kx=DH       Au=DSS  Enc=AES(256)  Mac=SHA256  
DHE-DSS-AES128-GCM-SHA256 TLSv1.2 Kx=DH       Au=DSS  Enc=AESGCM(128) Mac=AEAD  
DHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=DH       Au=RSA  Enc=AESGCM(128) Mac=AEAD  
DHE-RSA-AES128-SHA256   TLSv1.2 Kx=DH       Au=RSA  Enc=AES(128)  Mac=SHA256  
DHE-DSS-AES128-SHA256   TLSv1.2 Kx=DH       Au=DSS  Enc=AES(128)  Mac=SHA256  

Do note that you are excluding 4 PFS ciphers with your aECDSA:aECDH:kEDH:kRSA selection.

ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AESGCM(256) Mac=AEAD  
ECDHE-RSA-AES256-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AES(256)  Mac=SHA384  
ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AESGCM(128) Mac=AEAD  
ECDHE-RSA-AES128-SHA256 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AES(128)  Mac=SHA256  
1
  • aECDH does/did not exist in OpenSSL, kRSA is not PFS, and aECDSA includes some ECDHE suites but not others; kECDHE:kDHE directly gives all PFS -- including anon, which can most easily be removed by adding :!aNULL. In OpenSSL 1.0.2 when this was asked and answered the Q's spec excludes 9 ECDHE_RSA suites (the 4 you show, 2 more 'good' ones, and 3 'weak' ones, which Q didn't ask to exclude) plus 5 ECDH_anon. Since then 1.1.x in default build drops RC4 and 3DES and adds Camellia and then ARIA, making the omissions 10 or 12 and 3 respectively. Commented Jun 25, 2022 at 1:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .