This page (revision-1) was last changed on 29-Nov-2024 16:16 by UnknownAuthor

Only authorized users are allowed to rename pages.

Only authorized users are allowed to delete pages.

Page revision history

Version Date Modified Size Author Changes ... Change note

Page References

Incoming links Outgoing links
Cipher Suite
Cipher Suite

Version management

Difference between version and

At line 1 added 59 lines
!!! Overview
[{$pagename}] ([Cipher_suites]) defines the [cryptographic Primitives] or [algorithms] that are utilized in a particular [TLS]/[SSL] [session]
!! [{$pagename}] [SSL]/[TLS]
A [SSL]/[TLS] [Cipher Suite] is a 16-bit symbolic identifier for a set of [cryptographic] algorithms as listed in the [TLS Cipher Suite Registry]
For instance, the TLS_RSA_WITH_AES_128_CBC_SHA [{$pagename}] has value 0x002F, and means
* The [TLS] records use [HMAC]/[SHA-1] and [AES] [encryption] with a 128-bit key,
* the [key-Exchange] is done by encrypting a random key with the server's [RSA] [Public Key]"
There are many [Known Cipher Suites] and for [TLS] they are all supposedly registered at the [TLS Cipher Suite Registry]
Cipher suites are written like this:
{{{
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
}}}
which roughly breaks down into the following parameters:
* [TLS] - Could be [TLS] or [SSL]
* [ECDHE]: the [Key-Exchange] Mechanism.
* [RSA]: the [Authentication] mechanism.
* [Cipher] - the [Cipher] Algorithm
** [AES]
** 128 - The Strength
** [CBC]- Mode
* [SHA|Secure Hash Algorithm]: the [Message Authentication Code] primitive.
* [PRF|TLS PRF] - (not shown) only used in [TLS 1.2]
!! Special [{$pagename}]:
There are a couple of [{$pagename}] that are special
* [Anonymous Cipher Suite]
* TLS_NULL_WITH_NULL_NULL]
!! [{$pagename}] [SSL]/[TLS]
The order in the [ClientHello] shows what the client prefers, i.e. the preferred ciphers are on top.
The server is still free to ignore this order and pick what it thinks is best.
Often there is a related setting in the [TLS] configuration of the server, like SSLHonorCipherOrder for apache or ssl_prefer_server_ciphers for [NGINX].
!! [{$pagename}] [Kerberos Encryption Types]
[Kerberos Encryption Types] are similar to [{$pagename}] used in [Kerberos]
!! Which [{$pagename}]s to use
Generally which [{$pagename}]s to use depends on a lot of factors and configuration of your [Implementation],
A good place to start is using one of the [Certificate Validation Tools] and [Mozilla] maintains an excellent resource for [Server Side TLS Guidelines|https://wiki.mozilla.org/Security/Server_Side_TLS|target='_blank']
!! More Information
There might be more information for this subject on one of the following:
[{ReferringPagesPlugin before='*' after='\n' }]
* [#2] - [Server Side TLS Guidelines|https://wiki.mozilla.org/Security/Server_Side_TLS|target='_blank'] - based on information obtained 2019-01-28-
This page (revision-1) was last changed on 29-Nov-2024 16:16 by UnknownAuthorTop