46 votes

TLS Bicycle Attack - What cipher is free from flaws to use?

The PDF of the article begins with: It is usually assumed that HTTP traffic encapsulated in TLS doesn't reveal the exact sizes of its parts This is not what I would have said. Rather, let's say ...
user avatar
34 votes

How to disable CBC-mode ciphers

You can use !SHA1:!SHA256:!SHA384 to disable all CBC mode ciphers. There are some non-CBC false positives that will also be disabled (RC4, NULL), but you probably also want to disable them anyway. ...
user avatar
  • 1,370
25 votes
Accepted

Poodle - possible to protocol downgrade if SSLv3 is disabled but still have SSLv3 ciphers enabled?

If your server does not support SSLv3, then it does not support SSLv3. "Protocol downgrade attacks" are methods to force a client and server to use a protocol version that they both support even ...
user avatar
23 votes

"Optimal" Web Server SSL Cipher Suite Configuration

Of course, the first step is to keep OpenSSL (or the library you use) up to date. But as new vulnerabilities are discovered and browsers are upgraded, the answers here can (will) become outdated. I'd ...
user avatar
  • 730
23 votes
Accepted

Is TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 a safe cipher suite to use?

TLS ciphersuite names are structured in such a way that you can tell what algorithms and key sizes are used for each part of the handshake and encrypted session. Let's break this one down and see if ...
user avatar
  • 11.3k
18 votes
Accepted

How do I know which cipher suites can be disabled?

The required cipher suites depends entirely on the clients that are expected to use the service. As SSL Server Test from Qualys SSL Labs is designed for testing publicly accessible web servers, we can ...
user avatar
16 votes
Accepted

Should I worry if my credit card payment processor's server allows only weak SSL cipher suites?

Of course you should worry. If the credit card payment processor is not able to fix well known and obvious security problems (A few days ago RC4 got explicitly prohibited for use with TLS by the IETF) ...
user avatar
16 votes

Should I worry if my credit card payment processor's server allows only weak SSL cipher suites?

A payment processor who accepts RC4 is simply satisfying PCI requirements. (WAS - see update below) PCI does not disallow RC4. It does, however, consider the presence of BEAST to be a failure. And ...
user avatar
  • 71.9k
14 votes

Why does Google prefer ECDHE-RSA-AES128-GCM-SHA256?

AES-128 is not in practice weaker than AES-256. AES-128 is sufficiently robust that it won't be broken through exhaustive search on the key (see this answer for some details), and an algorithm cannot ...
user avatar
  • 169k
13 votes

In a browser web server communication, who decides which encryption protocol to use

To complement the answer from @raz, one must be aware of Protocol Downgrade Attacks. Browsers like IE send their maximum supported version, and then the server chooses (in your case, IE says "I know ...
user avatar
  • 169k
13 votes
Accepted

Using AES as a Stream Cipher

CTR mode is about encrypting data by generating a key dependent pseudo-random stream and XORing it with the data; so what you describe really is CTR mode, and you don't have to to the XOR yourself. ...
user avatar
  • 169k
13 votes
Accepted

How to change personal cipher/digest preferences of existing OpenPGP key in GnuPG?

OpenPGP Algorithm Defaults These are the algorithms you prefer others to use when they send encrypted messages to you. To print and change those settings, use gpg --edit-key [key-id]. You can list the ...
user avatar
  • 23.3k
13 votes

How to disable CBC-mode ciphers

I've spent a fair amount of time over the last couple of days trying to get a perfect list for ssllabs. Thanks in part to this, here's what works: SSLCipherSuite ALL:!RSA:!CAMELLIA:!aNULL:!eNULL:!...
user avatar
12 votes
Accepted

JSSE recommended cipher suites

It is always possible to be more paranoid, so you can shrink the list even more, depending on how worried you are. Basically: Remove the DH_anon cipher suites: they don't authenticate the server, ...
user avatar
  • 169k
12 votes

Can Poodle be fixed in SSLv3 or will it go the way of TLS compression?

There have been some discussions about mitigating issues with some record splitting. Namely, what makes Poodle efficient is that padding may use up to a full block (8 bytes with 3DES or RC2, 16 bytes ...
user avatar
  • 169k
11 votes
Accepted

In a browser web server communication, who decides which encryption protocol to use

The server chooses which cipher suite to use for establishing the secure channel. The client (browser) poses the protocols and encryption algorithms that it will accept. The server chooses the one ...
user avatar
  • 12.3k
11 votes
Accepted

TLS_RSA_WITH_3DES_EDE_CBC_SHA reported as 112 bits

You should disable all triple DES ciphers because 192 bit triple DES keys only have about 112 bits of security and 128 bit triple DES keys have even less than 112 bit security, rather around 80 bits ...
user avatar
10 votes
Accepted

Is CVE-2013-2566 a practical attack against RC4 or still conceptual?

As Matthew Green puts it, the attack "is just on the edge of feasibility". It conceptually applies to any protocol that uses RC4, although some are more vulnerable than others. The weakness of RC4 is ...
user avatar
10 votes
Accepted

What are the use cases for anonymous SSL cipher suites?

What are the use cases for anonymous cipher suites on a website? None. This is just a severe mistake and therefore the grade is capped to F. None of the browsers offers anonymous cipher suites (at ...
user avatar
10 votes

What are the use cases for anonymous SSL cipher suites?

That TLS includes such capability is not without good reason. It provides for confidentiality without the need for a certificate authority - an endpoint must be configured to remember what ...
user avatar
  • 18.3k
10 votes
Accepted

Is the order of cipher suites related to the client's preferences ?

The order in the ClientHello shows what the client prefers, i.e. the preferred ciphers are on top. The server is still free to ignore this order and pick what it thinks is best. Often there is a ...
user avatar
10 votes
Accepted

How to disable CBC-mode ciphers

According to the list of Cipher Strings given in the documentation (man ciphers) there is no string describing all CBC ciphers. This means there is no simple way to disable all of these (and only ...
user avatar
10 votes
Accepted

What are the 'P' values in some cipher string?

P521 is an elliptic curve “P521” is a dead giveaway for an elliptic curve which SECG and TLS formally call secp521r1 and which NIST FIPS 186-4 calls P-521. An elliptic curve is a mathematical domain ...
user avatar
9 votes

Why does my openssl connection fail with elliptic curve cipher ECDH-RSA-AES128-SHA?

That's because you are trying to use an ECDH cipher suite, and not and ECDHE cipher suite. ECDHE-RSA: the server's certificate contains an RSA public key; the server generates on-the-fly a new ...
user avatar
  • 169k
9 votes
Accepted

Can Poodle be fixed in SSLv3 or will it go the way of TLS compression?

SSLv3 protocol is flawed. This cannot be fixed. Generally, an attacker would exploit this by forcing the victim to connect to a server using SSLv3 by forcing connections using higher protocols to ...
user avatar
  • 1,275
9 votes
Accepted

How did SSLv3 get AES?

SSL 3.0 is not a standard. Realistically, it is "what Netscape was doing at that time". When the protocol was turned into a standard, it became RFC 2246, aka "TLS 1.0". The ...
user avatar
9 votes

DHE_DSS vs. DHE_RSA

DSS is a digital signature scheme published (but not invented) by the NSA. In TLS (TLS1.0, PKIX) it serves the same function as RSA and ECDSA: digital signatures prove that the server you're talking ...
user avatar
  • 7,688
8 votes
Accepted

ECDSA/RSA certificates and cipher selection

You can only use the ECDHE-RSA ciphers from that list if all you have is an RSA certificate. Same thing for ECDSA certificates, which only can be used with the ECDHE-ECDSA ciphers on that list. ECDH-*...
user avatar
  • 498
8 votes
Accepted

openssl ECDHE-RSA... cipher suite selected while using RSA server cert and ECDSA client cert

"ECDHE" means that the key exchange will use the Diffie-Hellman algorithm (over elliptic curves) with freshly generated DH elements; the last "E" stands for ephemeral. So while DH produces a shared ...
user avatar
8 votes

What are the 'P' values in some cipher string?

I would suggest that these mean the curve used within the ECDHE key exchange, i.e. NIST P-256, NIST P-384 and NIST P-521. These are not actually part of the cipher itself (i.e. the 16-bit cipher id ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible