When I go to this site, Chrome Version 44.0.2403.89 is connecting to the server with TLS_RSA_WITH_AES_128_CBC_SHA (0x2f), and it states that this is an "obsolete cipher suite".
For what reason is it called obsolete?
2
-
1I suspect that key exchange mechanism does not have forward secrecy. $\;$– user49075Commented Jul 24, 2015 at 11:46
-
That's correct, of course. But is this already enough to call a cipher suite obsolete?– HorstKevinCommented Jul 24, 2015 at 11:48
Add a comment
|
2 Answers
Here's the definition they use for non-obsolete cryptography:
In order for the message to indicate “modern cryptography”, the connection should use forward secrecy and either AES-GCM or CHACHA20_POLY1305. Other cipher suites are known to have weaknesses. Most servers will wish to negotiate TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256.
In this case the fact that there's no forward security is the main reason. CBC is also discouraged, due to the vulnerabilities caused by the dependence on proper padding and IV in some software.
There are known attacks against this ciphersuite. The main reason why this mode has been made obsolete is due to these attacks. I refer you to the Lucky 13 attack (by Nadhem AlFardan and Kenny Paterson), which is an advanced padding-oracle attack that uses time differences between padding and other errors. It is extremely difficult to overcome this in standard ways. This is explained in detail in the original explanation of the attack here, and in Adam Langley's explanation of the attack here.
The fact that the ciphersuite is not forward secure is also of importance, but certainly secondary to this.
