2

The following is a list of ciphers, how to know which ciphers are vulnerable to LogJam attack?

Client shared list of ciphers:

  1. TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
  2. TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
  3. TLS_RSA_WITH_AES_128_CBC_SHA
  4. TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
  5. TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
  6. TLS_DHE_RSA_WITH_AES_128_CBC_SHA
  7. TLS_DHE_DSS_WITH_AES_128_CBC_SHA
  8. TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
  9. TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
  10. TLS_RSA_WITH_3DES_EDE_CBC_SHA
  11. TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
  12. TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
  13. TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
  14. TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA
  15. TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
  16. TLS_ECDHE_RSA_WITH_RC4_128_SHA
  17. TLS_RSA_WITH_RC4_128_SHA
  18. TLS_ECDH_ECDSA_WITH_RC4_128_SHA
  19. TLS_ECDH_RSA_WITH_RC4_128_SHA
  20. TLS_RSA_WITH_RC4_128_MD5
  21. TLS_EMPTY_RENEGOTIATION_INFO_SCSV

Server chosen cipher: TLS_RSA_WITH_AES_128_CBC_SHA

  • 1
    Look under "What you should do" – RoraΖ Jun 9 '15 at 14:53
  • Don't use _DSS_ (it's not supported these days anyway), don't use _RC4_ (it's broken and deprecated), don't use _ECDH_ (nobody supports it anyway, but still, ECDHE is what you want). You've not listed AEAD (AES-GCM) cipher suites, these are the only ones that are considered secure. Add them. Reorder the list to be: ECDHE+ECDSA+AESGCM, ECDHE+aRSA+AESGCM, DHE+aRSA+AESGCM, ECDHE+ECDSA+AES, ECDHE+aRSA+AES, DHE+aRSA+AES, RSA+AES, RSA+3DES. The first three are secure, the next 3 at least provide PFS, the last 2 are for compatibility. DHE is really secure only if you use at least 2048 bit DHE. – Z.T. Jun 9 '15 at 19:19
  • Thanks for the reply, DH export cipher is vulnerable to logjam attack, but the list its being hard to find which are all DH export cipher – Prem M Jun 10 '15 at 3:43
5

Any with _DHE_ in them. Those are the ones that use Ephemeral Diffie-Hellman, _ECDHE_ is safe.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.