6

When I go to this site, Chrome Version 44.0.2403.89 is connecting to the server with TLS_RSA_WITH_AES_128_CBC_SHA (0x2f), and it states that this is an "obsolete cipher suite".

For what reason is it called obsolete?

screenshot

migrated from crypto.stackexchange.com Jul 24 '15 at 13:57

This question came from our site for software developers, mathematicians and others interested in cryptography.

  • 1
    I suspect that key exchange mechanism does not have forward secrecy. $\;$ – user49075 Jul 24 '15 at 11:46
  • That's correct, of course. But is this already enough to call a cipher suite obsolete? – HorstKevin Jul 24 '15 at 11:48
8

Here's the definition they use for non-obsolete cryptography:

In order for the message to indicate “modern cryptography”, the connection should use forward secrecy and either AES-GCM or CHACHA20_POLY1305. Other cipher suites are known to have weaknesses. Most servers will wish to negotiate TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256.

In this case the fact that there's no forward security is the main reason. CBC is also discouraged, due to the vulnerabilities caused by the dependence on proper padding and IV in some software.

7

There are known attacks against this ciphersuite. The main reason why this mode has been made obsolete is due to these attacks. I refer you to the Lucky 13 attack (by Nadhem AlFardan and Kenny Paterson), which is an advanced padding-oracle attack that uses time differences between padding and other errors. It is extremely difficult to overcome this in standard ways. This is explained in detail in the original explanation of the attack here, and in Adam Langley's explanation of the attack here.

The fact that the ciphersuite is not forward secure is also of importance, but certainly secondary to this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.