Hot answers tagged

32

I think it's easier to split this into its component parts, and consider them as separate entities: AES and CBC. AES itself does not "basically consist of XORing together chunks of the block" - it's a much more complicated affair. Ignoring the internals of it for a moment, AES is considered secure in that without knowing the key, it's practically impossible ...


16

The required cipher suites depends entirely on the clients that are expected to use the service. As SSL Server Test from Qualys SSL Labs is designed for testing publicly accessible web servers, we can assume this is a web application. All current versions of major browsers are able to handle TLS 1.2+ with the recommended cipher suites from RFC 7525, 4.2, ...


13

No, afaik. Also, if it is supposed to be readable and helpful for non-tech people, each translation might be a book for itself, explaining each part of those strings, it's up- and down sides in painful detail. Just in case you didn't know, rfc 5246 currently covers this format and includes a table with cipher suites that might send you down a helpful track....


10

2017-11-01 update: MIT Security analysis of Telegram finds it to be insecure. Quote from the following paper ...”our survey shows that Telegram has had serious and simple issues in the protocol (e.g. modified buggy Diffie-Hellman key exchange) that any knowledgeable security expert could penetrate.” https://courses.csail.mit.edu/6.857/2017/project/19.pdf ...


9

No, because the key is secret. The "block cipher encryption" block in the diagram scrambles the data depending on the key. The XOR in the diagram does not provide the security, the encryption does. The XOR and the IV are just to make sure the same plaintext encrypts as different ciphertext for each block.


9

The order in the ClientHello shows what the client prefers, i.e. the preferred ciphers are on top. The server is still free to ignore this order and pick what it thinks is best. Often there is a related setting in the TLS configuration of the server, like SSLHonorCipherOrder for apache or ssl_prefer_server_ciphers for nginx. Cloudflare at least makes use of ...


9

Don't do this. At least, don't do this on any system where you don't know for sure that it's not going to break things. AEAD stands for "Authenticated Encryption with Additional Data" meaning there is a built-in message authentication code for integrity checking both the ciphertext and optionally additional authenticated (but unencrypted) data, and the ...


9

This is a feature to prevent servers to get buggy. From GREASE for TLS: TLS clients offer lists of 16-bit code points (e.g. cipher suites) that servers select from. To remain extensible, servers must ignore unknown values. However, servers may have bugs and reject unknown values. These servers will interoperate with existing clients, so the mistake may ...


8

RC4 is an algorythm, not some piece of software. It's the same difference between an idea and a book: you can attempt to suppress a book that carries a specific idea but you cannot suppress the idea itself. Likewise, you cannot globally disable RC4 with a registry edit. At best, you will instruct software that reads that registry key not to use RC4. ...


8

Use AES-256 (because it stops people from lecturing you about quantum computers). If you don't have particular (performance) requirements in mind, 256-bit AES is a good and safe choice. But that doesn't mean there are practical attacks against the other ciphers. Ultimately, it's a matter of personal preference since nobody can predict which theoretical ...


8

A cryptographic algorithm can be any specific mathematical description (the algorithm) related to cryptography. There are specific types of algorithms such as hash algorithms, block ciphers, stream ciphers, signature algorithms, pseudo-random number generators etc. Cryptographic algorithms may be used to perform encryption / decryption. In that case the ...


7

The problem is not the SHA1 but the CBC. You need to offer an AEAD cipher like the GCM ciphers or CHACHA20-POLY1305. From the Chromium (base for Chrome) projects documentation about cipher suites: To avoid this message, use TLS 1.2 and prioritize an ECDHE cipher suite with AES_128_GCM or CHACHA20_POLY1305. Most servers will wish to negotiate ...


7

A cipher is a cryptographic algorithm. Stream ciphers generate keystream by x-oring the plaintext to encrypt. They are very fast compared to block ciphers. A benchmark comparison can be seen at WolfSSL website, compare AES-128 vs ChaCha. Block ciphers operate on blocks as Advanced Encryption Standard (AES) is 128-bit block-size. AES is one of the Block ...


7

I would suggest that these mean the curve used within the ECDHE key exchange, i.e. NIST P-256, NIST P-384 and NIST P-521. These are not actually part of the cipher itself (i.e. the 16-bit cipher id used in the TLS handshake) but it looks like Microsoft has added it to their cipher syntax. There's really no difference between cipher suites with and without ...


7

P521 is an elliptic curve “P521” is a dead giveaway for an elliptic curve which SECG and TLS formally call secp521r1 and which NIST FIPS 186-4 calls P-521. An elliptic curve is a mathematical domain used by elliptic curve algorithm such as ECDH and ECDSA. Curves are generally known by a name that includes some information about the type of curve and the ...


6

A TLS cipher consists of a part defining the authentication of the certificate (i.e. ECDSA, RSA...), a part defining the key exchange (ECDHE, DHE...) and a part about the kind of symmetric encryption and the associated HMAC, i.e. RC4+SHA1, AES128+SHA256 etc. From these parts only the authentication part depends on the type of certificate and everything ...


6

As an addon to Trey's answer: I use the string ALL:COMPLEMENTOFALL when want I every cipher suite. I use the -V (upper case V) option to make OpenSSL output the hex-IDs of the cipher suites. Note: OpenSSL is not authoritative for answering these questions. IANA is. (But I couldn't get their CSV file parsed nicely.) $ ./openssl version OpenSSL 1.1.0-pre6-...


6

A simple grep would not provide enough context to determine if there is a problem. Even if your find actual uses for these less secure algorithms (contrary to just finding code which uses these names for other things) it is still not clear if there is a real problem. For example, MD5 and SHA-1 are no problem when used as HMAC. Thus, you actually need to look ...


5

All modern encryption methods (AES, blowfish etc.) are designed to be much more secure than you seem to expect. Let us quickly look at some attacks which such ciphers are designed to be resistant against. Known plain text attack - In this case we assume the attacker has access to many plain text blocks along with corresponding cipher text blocks encrypted ...


5

The IANA maintains the official registry for defined cipher suites. Each cipher suite is a 16-bit identifier; the "symbolic name" is not nominally standard; most implementations use the names indicated in the registry, but sometimes not, like OpenSSL. OpenSSL has its own naming scheme. With the IANA registry, you can look up the cipher suite name, which ...


5

Update: this answer applies to TLS through 1.2 only. TLS 1.3 in 2018 changes the handshake radically, and now keyexchange, authentication, and symmetric (data) encryption/MAC are indepedent with only the last (plus KDF) determined by the 'ciphersuite'. And RC4 is no longer permitted at all, mooting this Q. TLDR: in limited cases yes, but don't First, key-...


5

1.) See openssl output below and excellent Wikipedia page below 2.) No not all of them, see the tables at the URL below. 3.) No not all of them, see the tables at the URL below. https://en.wikipedia.org/wiki/Transport_Layer_Security openssl ciphers -v 'ALL:!aNULL' ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD ...


5

I think you are mixing brute-force attacks where bit size is relevant and other attacks. The 112 bit you refer to are probably from 3DES. This algorithm is not considered weak because of only 112 bit strength but because birthday attacks are possible: see the Sweet32 attack.


5

You are asking multiple unrelated questions which is not the recommended way to ask and chances are that the question might be closed as too broad or as duplicate since some part was already answered somewhere else. Still, to give some short answers: As per the doc, the Ciphers marked as "E" is the weak cipher and in another way can I consider the cipher ...


5

They are the naming for NIST ECC Curves. Also see at NIST.FIPS.186-4 NIST RFC 4492 P-256 secp256r1 P-384 secp384r1 P-521 secp521r1


5

If I where you I would look at Cryptanalysis, in particular letter frequency. The idea of which, certain letters in English occur more regularly than others (e.g. vowels).


5

"and then use the result as their master password on LastPass" The proposed "algorithm" is in essence just a fancy key expansion. As you surmised, it is security through obscurity. If one knew that I was using a base64 encoding of a plaintext crunched through (say) Bifid, he would be able to brute force the database much faster: the plaintext would ...


5

Yes, the documentation you are looking for are the RFC documents for the various versions. Here are the links to the RFCs for TLS 1.0, 1.1, 1.2 and 1.3: TLS 1.0 TLS 1.1 TLS 1.2 TLS 1.3 Since this would be a link-only answer, here the core of each RFC. TLS 1.0 The chapter 9. Mandatory Cipher Suits reads the following: In the absence of an application ...


4

Is it supported by any browsers for accessing any web-sites over the https:// address scheme? I think you are referring to TLS_NULL_WITH_NULL_NULL or similar ciphers were no encryption is done. None of the current browsers offers this cipher and I don't think that there will be a reason in the future to offer such more than weak ciphers because you would ...


4

I tested Chrome and Firefox, both mobile on ssllabs.com: Chrome Cipher Suites (in order of preference) TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca9) Forward Secrecy 256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca8) Forward Secrecy 256 OLD_TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (0xcc14) Forward Secrecy 256 ...


Only top voted, non community-wiki answers of a minimum length are eligible