302

I dug out my copy of Applied Cryptography to answer this concerning symmetric crypto, 256 is plenty and probably will be for a long long time. Schneier explains; Longer key lengths are better, but only up to a point. AES will have 128-bit, 192-bit, and 256-bit key lengths. This is far longer than needed for the foreseeable future. In fact, we cannot even ...


78

The reason why RSA keys are so small is that: With every doubling of the RSA key length, decryption is 6-7 times times slower. So this is just another of the security-convenience tradeoffs. Here's a graph: Source: http://www.javamex.com/tutorials/cryptography/rsa_key_length.shtml


52

"Best" is rather subjective - it depends on your requirements. That said, I'll give you a general overview of each mode. ECB - Electronic Code Book. This mode is the simplest, and transforms each block separately. It just needs a key and some data, with no added extras. Unfortunately it sucks - for a start, identical plaintext blocks get encrypted into ...


49

The most secure setup doesn't depend only on ciphers, but also on the tls-version used. For openssl, tls 1.1/1.2 is preferred. BEAST and CRIME are attacks on the client and are usually mitigated client-side, but there are server-side mitigations too: CRIME: just disable ssl-compression; that's it BEAST/Lucky13: just use TLS 1.1, no SSLv3 and no RC4, see Is ...


46

The PDF of the article begins with: It is usually assumed that HTTP traffic encapsulated in TLS doesn't reveal the exact sizes of its parts This is not what I would have said. Rather, let's say that it is usually assumed by people who do not know better. TLS is encryption and encryption is good at hiding data contents, not data length. This is not ...


37

First things first: don't panic. Don't do anything rash, and take time to think. The slides which have appeared today describe new results on bias in RC4. RC4 generates a key-dependent stream of pseudo-random bytes, which is then XORed with the data to encrypt (decryption is identical). It was known that the output of RC4 was slightly biased, i.e. some byte ...


30

Figuring out which cipher suites to remove can be very difficult. For Windows, I've used the free IIS Crypto tool in the past: IIS Crypto is a free tool that gives administrators the ability to enable or disable protocols, ciphers, hashes and key exchange algorithms on Windows Server 2003, 2008 and 2012. It also lets you reorder SSL/TLS cipher suites ...


27

The "arcfour" cipher is defined in RFC 4253; it is plain RC4 with a 128-bit key. "arcfour128" and "arcfour256" are defined in RFC 4345. They use a key of 128-bit or 256-bit, respectively. Moreover, and contrary to plain "arcfour", they also include a "discard" step: the very first 1536 bytes produced by the cipher are dropped. This is done because the first ...


27

In the year since this answer was written, Mozilla's guide has been updated regularly. All of my reservations below have been taken into account, and I recommend the guide wholeheartedly. I recommend that you read Mozilla's Server Side TLS guide. It's comprehensive, and they are especially careful about compatibility with old clients, sometimes to the ...


25

If your server does not support SSLv3, then it does not support SSLv3. "Protocol downgrade attacks" are methods to force a client and server to use a protocol version that they both support even though they both know at least one newer version that they would have wished to use, given the choice. Anecdote: I am French. Back in 2005, I was walking in the ...


22

Of course, the first step is to keep OpenSSL (or the library you use) up to date. But as new vulnerabilities are discovered and browsers are upgraded, the answers here can (will) become outdated. I'd suggest you rely on the Mozilla SSL Configuration Generator to check which configuration you should use.


20

TLS ciphersuite names are structured in such a way that you can tell what algorithms and key sizes are used for each part of the handshake and encrypted session. Let's break this one down and see if there are any improvements we can make: TLS - This doesn't signify anything in itself, but does allow me to mention that TLS 1.2 is the latest version of TLS ...


19

What you describe is not forward secrecy. Forward secrecy relates to the following property: a secured communication took place between entities A and B at some time T; the attacker recorded all the messages; at some later time T' the attacker obtains a copy of all the secret keys known to A and B; and yet, the attacker cannot recover the contents of the ...


18

The default algorithms (that is, the algorithms which the client and server prefer to use when given the choice) depend on the client and server implementations, how they were compiled and configured. So it may depend on the software vendor, software version, operating system distribution, and sysadmin choices. On an Ubuntu 12.10, man ssh_config indicates ...


16

The required cipher suites depends entirely on the clients that are expected to use the service. As SSL Server Test from Qualys SSL Labs is designed for testing publicly accessible web servers, we can assume this is a web application. All current versions of major browsers are able to handle TLS 1.2+ with the recommended cipher suites from RFC 7525, 4.2, ...


15

GCM is recommended; it is even approved by NIST. However, AEAD ciphers are supported in TLS only since TLS 1.2; see section 6.2.3.3, which is new, when compared to TLS 1.1. The actual GCM-able cipher suites are defined in RFC 5288. Note that TLS 1.2 (and, for that matter, TLS 1.1 too) is immune to BEAST-like attacks when using CBC. Therefore you will have a ...


15

Of course you should worry. If the credit card payment processor is not able to fix well known and obvious security problems (A few days ago RC4 got explicitly prohibited for use with TLS by the IETF) which are even visible world-wide from outside, how will be the status of their internal security? Note, that it might be not that bad to offer RC4 for ...


15

A payment processor who accepts RC4 is simply satisfying PCI requirements. (WAS - see update below) PCI does not disallow RC4. It does, however, consider the presence of BEAST to be a failure. And if they're going to mitigate BEAST and still remain widely compatible, they need RC4 - "The only reliable way to defend against BEAST is to prioritise RC4 ...


14

Security: if you don't do stupid things like using a 512-bit RSA key, these cipher suites are all equally secure: they are all very far in the "cannot break it" zone. So that's a meh. You cannot say that one is more secure than any other. With an exception though: the "ECDHE" suites use an ephemeral key pair for actual encryption; since the corresponding ...


14

AES-128 is not in practice weaker than AES-256. AES-128 is sufficiently robust that it won't be broken through exhaustive search on the key (see this answer for some details), and an algorithm cannot be "less broken" than "not broken", so there is no additional benefit for security from cranking up the key size to 256 bits. (There are benefits for marketing,...


13

This could be encrypted with any key length that is equal or longer than 28 characters (sum of lengths of ciphertext you provided) and as such unsolvable. The character variation between the plaintext CANDY VERY CRANBERRYhttphttp and its ciphertext TXOtWjYhVk 8&O$4AmSAcZf.r5Hz is: 17,23,1,48,-2,74,3,35,4,18,0,-11,-44,14,-42,-14,-4,27,1,-24,-5,-26,-14,-...


13

To complement the answer from @raz, one must be aware of Protocol Downgrade Attacks. Browsers like IE send their maximum supported version, and then the server chooses (in your case, IE says "I know up to TLS 1.2" and the server responds with "we will do TLS 1.0"). However, browsers know that there exist buggy servers out there, that will simply have an ...


13

You can use !SHA1:!SHA256:!SHA384 to disable all CBC mode ciphers. There are some non-CBC false positives that will also be disabled (RC4, NULL), but you probably also want to disable them anyway. Note that while GCM and CHACHA20 ciphers have SHA* in their name, they're not disabled because they use their own MAC algorithm. The SHA* in their name is for the ...


12

CTR mode is about encrypting data by generating a key dependent pseudo-random stream and XORing it with the data; so what you describe really is CTR mode, and you don't have to to the XOR yourself. Said otherwise, by encrypting a bunch of zeros and then XORing the result with your actual data, you are just doing a needless extra XOR with zeros. (You are ...


12

There have been some discussions about mitigating issues with some record splitting. Namely, what makes Poodle efficient is that padding may use up to a full block (8 bytes with 3DES or RC2, 16 bytes with AES). When this happens, only the last byte of the block is checked by the recipient, which is why the alteration from the attacker gets through with ...


12

OpenPGP Algorithm Defaults These are the algorithms you prefer others to use when they send encrypted messages to you. To print and change those settings, use gpg --edit-key [key-id]. You can list the settings in a more readable way without looking up the algorithm IDs in RFC 4880 using showpref , and set it afterwards using setpref. Changing Defaults ...


11

The client suggests but the server chooses. The client sends a list of the cipher suites that it supports (and is willing to use). This list is supposed to be ordered by preference. The server responds by choosing one cipher suite in this list. Well-behaved servers try to follow the preferences of clients, but that's not really mandatory. Ultimately, the ...


11

It is always possible to be more paranoid, so you can shrink the list even more, depending on how worried you are. Basically: Remove the DH_anon cipher suites: they don't authenticate the server, hence they are weak against MitM attacks. Don't use RC4, since it has known biases. Don't use 3DES because its short block size (8 bytes) makes it troublesome past ...


11

The server chooses which cipher suite to use for establishing the secure channel. The client (browser) poses the protocols and encryption algorithms that it will accept. The server chooses the one it deems most secure (based on its own list of acceptable protocols) and that is used for the secure channel. If the server does not see any cipher suites that ...


Only top voted, non community-wiki answers of a minimum length are eligible