35
votes
How to disable CBC-mode ciphers
You can use !SHA1:!SHA256:!SHA384 to disable all CBC mode ciphers. There are some non-CBC false positives that will also be disabled (RC4, NULL), but you probably also want to disable them anyway.
...
- 1,380
18
votes
Accepted
How do I know which cipher suites can be disabled?
The required cipher suites depends entirely on the clients that are expected to use the service. As SSL Server Test from Qualys SSL Labs is designed for testing publicly accessible web servers, we can ...
- 19.4k
16
votes
How to disable CBC-mode ciphers
I've spent a fair amount of time over the last couple of days trying to get a perfect list for ssllabs. Thanks in part to this, here's what works:
SSLCipherSuite ALL:!RSA:!CAMELLIA:!aNULL:!eNULL:!...
- 261
13
votes
Accepted
What are the 'P' values in some cipher string?
P521 is an elliptic curve
“P521” is a dead giveaway for an elliptic curve which SECG and TLS formally call secp521r1 and which NIST FIPS 186-4 calls P-521. An elliptic curve is a mathematical domain ...
13
votes
Accepted
SSH Server Configuration Best Practices?
The defaults for a recent version of openssh are good.
The server's asymmetric key type and client's asymmetric key type are specified in
HostKeyAlgorithms and PubkeyAcceptedAlgorithms respectively.
...
- 8,644
12
votes
Accepted
How to disable CBC-mode ciphers
According to the list of Cipher Strings given in the documentation (man ciphers) there is no string describing all CBC ciphers. This means there is no simple way to disable all of these (and only ...
- 208k
8
votes
What are the 'P' values in some cipher string?
I would suggest that these mean the curve used within the ECDHE key exchange, i.e. NIST P-256, NIST P-384 and NIST P-521. These are not actually part of the cipher itself (i.e. the 16-bit cipher id ...
- 208k
6
votes
Accepted
OpenSSH: Meaning of cipher with email address @openssh.com
Those are algorithms defined by vendors like openssh, not defined by the SSH standard (IETF RFCs). They are extensions to the protocol. Of course, you are not guaranteed that software other than ...
- 8,644
6
votes
Accepted
How are key exchange and signature algorithms negotiated in TLS 1.3
Summary
Key Exchange Method (eg. DHE, PSK or DHE+PSK), negotiated using the pre_shared_key and psk_key_exchange_modes extensions.
Diffie-Hellman group used for the DHE (eg. ffdhe8192, secp256r1, etc.),...
- 2,490
5
votes
Guidelines for TLS cipher suites?
Mozilla: https://mozilla.github.io/server-side-tls/ssl-config-generator/
SSL Labs: https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practices
Cipherli.St: https://cipherli.st/
...
- 18.2k
5
votes
Accepted
TLS Cipher Suites for MTA
Even with ciphers using 3DES or RC4 an attacker is not able to crack the cipher with moderate costs. And even secret services would probably rather do DNS MX spoofing or simply strip the STARTTLS from ...
- 208k
5
votes
OpenSSH default/preferred ciphers, hash, etc for SSH2
Answer valid in 2023:
By default, OpenSSH uses the [email protected] cipher. Although, between machines with AES-NI support, you might want to force e.g. [email protected].
$ man ...
- 599
5
votes
Clarifications regarding ciphers and Nmap scan
You are asking multiple unrelated questions which is not the recommended way to ask and chances are that the question might be closed as too broad or as duplicate since some part was already answered ...
- 208k
5
votes
How does a client (like SSLLabs) know all the cipher suites a server supports if the server doesn’t send its list of supported cipher suites?
In TLS the client announces what kind of ciphers it supports inside the ClientHello and the server picks a cipher from these which is supported on the server too. While one cannot query the server ...
- 208k
5
votes
What are the 'P' values in some cipher string?
They are the naming for NIST ECC Curves. Also see at NIST.FIPS.186-4
NIST RFC 4492
P-256 secp256r1
P-384 secp384r1
P-521 secp521r1
- 5,589
5
votes
How do I verify the supported ciphersuites of a TLS server that only accepts POST requests?
It is totally irrelevant if GET or POST is used. The TLS handshake is done before any HTTP request is even send. So if the handshake fails it means that neither GET nor POST is possible. If the ...
- 208k
5
votes
Which cipher is more secure TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA or TLS_RSA_WITH_AES_256_GCM_SHA384?
Neither cipher suite is good. Which one is the least bad depends on your threat model.
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA has two problems:
It uses SHA-1 to authenticate the server's signature. SHA-1 ...
5
votes
If I control both sides of a connection, is there any reason to support alternate cipher suites?
If you control both ends of the tunnel, and there are no issues with intermediary server support, then it definitely makes sense to limit the ciphers. Additional ciphers just increases the attack ...
- 638
4
votes
How to make TLS_RSA_WITH_3DES_EDE_CBC_SHA strong
If following that guide you used this line in your nginx configuration:
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-...
- 8,644
4
votes
What is the difference between CBC and CBC3 cipher suites?
DES-CBC-SHA is DES encryption, SHA-1 as HMAC.
DES-CBC3-SHA is 3DES encryption, SHA-1 as HMAC.
- 208k
4
votes
ISO 9564 Approved Encryption Algorithms for PIN, why symmetric block ciphers?
The reason ISO PIN blocks are used instead of a hash is related to the structure of the payments industry.
The diagram above shows the simplified data flows for a PIN transaction. The ISO PIN block ...
4
votes
Why does tls_version "TLS 1.2" from howsmyssl rate "Probably Okay" in Chrome on Windows 10 but "Bad" in IE11 on Windows 7?
Well, from the error message you posted, your IE11 is willing to use some really out of date and broken crypto, but the Chrome does not. That tool even gives you a helpful description of why each one ...
- 59.3k
4
votes
What makes an SSL session pick one cipher over another?
In the first step the server aligns the ciphers offered by the client with the ciphers configured for the cipher to get a set of common ciphers. From this set the server then selects a single cipher. ...
- 208k
4
votes
Accepted
Understanding SSL Cipher suite in Apache
Yes, the order of Apache's SSLCipherSuite indicates the preferred order. To quote the link you've provided (emphasis mine),
Now where this becomes interesting is that these can be put together
...
- 73.3k
4
votes
When connecting via SSH, does the Diffie-Hellman key exchange take place over an unencrypted TCP session or does encryption occur before the exchange?
See RFC 5656, section 4, which describes the protocol for Diffie Hellman key exchange for SSH. I've coped the diagram from this section below:
Client ...
- 24k
4
votes
OpenSSH: Meaning of cipher with email address @openssh.com
By the way, that's a domain name, not an email address. As explicitly pointed out in RFC4251 section 6:
There are two formats for algorithm and method names:
o Names that do not contain an at-...
- 11.1k
4
votes
Accepted
How does TLS use hashing from the negotiated cipher suite
There are a couple places we use a hash in TLS. The first is as part of the signature. This is decided by means outside the cipher suite (usually the negotiation of the curve we're using for ECDSA) ...
- 9,712
4
votes
Java support for TLS_DHE_RSA_WITH_AES_128_CCM
This is very dependent on the version on the JRE that you are using, and thus on the version of JSSE it ships. It also depends on your local configuration, notably the jdk.tls.client.cipherSuites and ...
- 5,507
4
votes
server negotiating TLS1.3 but sent TLS1.2 ciphersuite
You basically describe a behavior where the server violates the standard, i.e. using a TLS 1.2 cipher with TLS 1.3. Common reaction to non-standard behavior of the server is to simply close the ...
- 208k
3
votes
Server negotiated HTTP/2 with blacklisted suite
These suits included in the list of ciphersuites prohibited by HTTP/2 defined in RFC 7540.
Since AES-GCM and RSA still enjoy a good reputation, the remaining weakness of the second suite is that it ...
- 12.2k
Only top scored, non community-wiki answers of a minimum length are eligible