46
votes
TLS Bicycle Attack - What cipher is free from flaws to use?
The PDF of the article begins with:
It is usually assumed that HTTP traffic encapsulated in TLS doesn't reveal the exact sizes of its parts
This is not what I would have said. Rather, let's say ...
- 325k
35
votes
How to disable CBC-mode ciphers
You can use !SHA1:!SHA256:!SHA384 to disable all CBC mode ciphers. There are some non-CBC false positives that will also be disabled (RC4, NULL), but you probably also want to disable them anyway.
...
- 1,380
18
votes
Accepted
How do I know which cipher suites can be disabled?
The required cipher suites depends entirely on the clients that are expected to use the service. As SSL Server Test from Qualys SSL Labs is designed for testing publicly accessible web servers, we can ...
- 18.7k
15
votes
Why does Google prefer ECDHE-RSA-AES128-GCM-SHA256?
AES-128 is not in practice weaker than AES-256. AES-128 is sufficiently robust that it won't be broken through exhaustive search on the key (see this answer for some details), and an algorithm cannot ...
- 172k
15
votes
How to disable CBC-mode ciphers
I've spent a fair amount of time over the last couple of days trying to get a perfect list for ssllabs. Thanks in part to this, here's what works:
SSLCipherSuite ALL:!RSA:!CAMELLIA:!aNULL:!eNULL:!...
- 251
12
votes
Accepted
How to disable CBC-mode ciphers
According to the list of Cipher Strings given in the documentation (man ciphers) there is no string describing all CBC ciphers. This means there is no simple way to disable all of these (and only ...
- 198k
12
votes
Accepted
What are the 'P' values in some cipher string?
P521 is an elliptic curve
“P521” is a dead giveaway for an elliptic curve which SECG and TLS formally call secp521r1 and which NIST FIPS 186-4 calls P-521. An elliptic curve is a mathematical domain ...
11
votes
Accepted
TLS_RSA_WITH_3DES_EDE_CBC_SHA reported as 112 bits
You should disable all triple DES ciphers because 192 bit triple DES keys only have about 112 bits of security and 128 bit triple DES keys have even less than 112 bit security, rather around 80 bits ...
- 4,633
11
votes
What are the use cases for anonymous SSL cipher suites?
That TLS includes such capability is not without good reason.
It provides for confidentiality without the need for a certificate authority - an endpoint must be configured to remember what ...
- 18.6k
11
votes
Accepted
What are the use cases for anonymous SSL cipher suites?
What are the use cases for anonymous cipher suites on a website?
None. This is just a severe mistake and therefore the grade is capped to F.
None of the browsers offers anonymous cipher suites (at ...
- 198k
10
votes
Accepted
Is the order of cipher suites related to the client's preferences ?
The order in the ClientHello shows what the client prefers, i.e. the preferred ciphers are on top. The server is still free to ignore this order and pick what it thinks is best. Often there is a ...
- 198k
9
votes
Accepted
SSH Server Configuration Best Practices?
The defaults for a recent version of openssh are good.
The server's asymmetric key type and client's asymmetric key type are specified in
HostKeyAlgorithms and PubkeyAcceptedAlgorithms respectively.
...
- 8,434
8
votes
What are the 'P' values in some cipher string?
I would suggest that these mean the curve used within the ECDHE key exchange, i.e. NIST P-256, NIST P-384 and NIST P-521. These are not actually part of the cipher itself (i.e. the 16-bit cipher id ...
- 198k
7
votes
TLS_RSA_WITH_3DES_EDE_CBC_SHA reported as 112 bits
Maarten's answer is excellent, but to expand on it a bit, you may want to read up on Meet-in-the-Middle attacks. The idea is, when you have a cryptographic cipher that consists of performing the same ...
- 46.3k
7
votes
TLS Version specific cipher suites
As an addon to Trey's answer:
I use the string ALL:COMPLEMENTOFALL when want I every cipher suite.
I use the -V (upper case V) option to make OpenSSL output the hex-IDs of the cipher suites.
Note: ...
- 18k
7
votes
Accepted
Can web server have TLS version specific cipher suite configuration?
In theory it would be possible to set the available ciphers and cipher order depending on the TLS protocol version used by the client.
In practice none of the common web servers supports this.
Apart ...
- 198k
6
votes
SSH ciphers, MAC and key-exchange (and pen-tests thereof)
Unfortunately the standards bodies don't fully agree on a single list of ciphers for SSL/TLS or SSH security. The following document and it's internal references will help a lot and I would think that ...
- 14.2k
6
votes
Accepted
TLS Version specific cipher suites
1.) See openssl output below and excellent Wikipedia page below
2.) No not all of them, see the tables at the URL below.
3.) No not all of them, see the tables at the URL below.
https://en....
- 14.2k
5
votes
Accepted
Firefox & Chrome Strong Ciphers
I tested Chrome and Firefox, both mobile on ssllabs.com:
Chrome
Cipher Suites (in order of preference)
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca9) Forward Secrecy 256
...
- 1,106
5
votes
Accepted
Link between Cipher suites and certificate key
wikipedia.org has an EC 256 bits key and TLS_RSA_WITH_AES_128_CBC_SHA is an accepted cipher suite. According to this post SSL certificates and cipher suites correspondence (if I understand it ...
- 198k
5
votes
Guidelines for TLS cipher suites?
Mozilla: https://mozilla.github.io/server-side-tls/ssl-config-generator/
SSL Labs: https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practices
Cipherli.St: https://cipherli.st/
...
- 18k
5
votes
Accepted
TLS Cipher Suites for MTA
Even with ciphers using 3DES or RC4 an attacker is not able to crack the cipher with moderate costs. And even secret services would probably rather do DNS MX spoofing or simply strip the STARTTLS from ...
- 198k
5
votes
Clarifications regarding ciphers and Nmap scan
You are asking multiple unrelated questions which is not the recommended way to ask and chances are that the question might be closed as too broad or as duplicate since some part was already answered ...
- 198k
5
votes
How does a client (like SSLLabs) know all the cipher suites a server supports if the server doesn’t send its list of supported cipher suites?
In TLS the client announces what kind of ciphers it supports inside the ClientHello and the server picks a cipher from these which is supported on the server too. While one cannot query the server ...
- 198k
5
votes
What are the 'P' values in some cipher string?
They are the naming for NIST ECC Curves. Also see at NIST.FIPS.186-4
NIST RFC 4492
P-256 secp256r1
P-384 secp384r1
P-521 secp521r1
- 5,519
5
votes
How do I verify the supported ciphersuites of a TLS server that only accepts POST requests?
It is totally irrelevant if GET or POST is used. The TLS handshake is done before any HTTP request is even send. So if the handshake fails it means that neither GET nor POST is possible. If the ...
- 198k
5
votes
Accepted
OpenSSH: Meaning of cipher with email address @openssh.com
Those are algorithms defined by vendors like openssh, not defined by the SSH standard (IETF RFCs). They are extensions to the protocol. Of course, you are not guaranteed that software other than ...
- 8,434
4
votes
OpenSSH default/preferred ciphers, hash, etc for SSH2
Answer valid in 2023:
By default, OpenSSH uses the [email protected] cipher. Although, between machines with AES-NI support, you might want to force e.g. [email protected].
$ man ...
- 589
4
votes
Can browsers connect HTTPS w/ the NONE cipher?
Is it supported by any browsers for accessing any web-sites over the https:// address scheme?
I think you are referring to TLS_NULL_WITH_NULL_NULL or similar ciphers were no encryption is done. None ...
- 198k
4
votes
Accepted
How to disable weak cipher suits in java application server for ssl
JAVA allows cipher suites to be removed/excluded from use in the security policy file called java.security that’s located in your JRE: $PATH/[JRE]/lib/security The jdk.tls.disabledAlgorithms property ...
- 8,692
Only top scored, non community-wiki answers of a minimum length are eligible