Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am building an Apache webserver with TLS 1.2 and OpenSSL 1.0.1. So far, I have enabled 2 encryption algorithms - ECDHE AES256 GCM and ECHDE AES128 GCM.

Firefox and Chrome(ium) use NSS which currently does not support AES256 GCM, but it works with AES256 CBC. Because they do not support AES256 GCM, they fall back to AES128 GCM.

I would like to enable AES256 CBC, but I am not sure about the security of it.

This site states multiple times that CBC is insecure and should not be used.

Is it safer to use AES128 GCM or AES256 CBC?

share|improve this question
SSL made an unfortunate choice when combining AES-CBC with MACs. This means that it's quite hard to implement CBC correctly. It isn't easy to implement GCM in a way that resists timing attacks on a CPU without AES-NI, so it's not perfect either. – CodesInChaos Feb 22 '14 at 19:28
I wouldn't care too much about key-size. 128 bits is already quite strong. – CodesInChaos Feb 22 '14 at 19:29
So it's hard to implement correctly. But is the OpenSSL implementation correct? I just want to know whether it is at least as safe as GCM. (Because as far as I know the server is what controls the encryption, so if the server implementation is correct it is safe. Or does it also depend on the client?) – the_pwner224 Feb 22 '14 at 19:59
up vote 1 down vote accepted

Because AES CBC does not provide authenticated encryption, this leads to many interesting attacks, which allow to modify or guess plaintext. Such attacks as BEAST or Lucky 13 are based on this vulnerability of AES CBC. Some details about this attacks you can find here.

share|improve this answer
SSL still provides authentication even with CBC based modes. The real problem is that SSL combines AES-CBC with a MAC in a MAC-then-authenticate scheme, which is pretty hard to implement. Older SSL versions also don't choose unpredictable IVs, which CBC requires. So these problems are not inherent in CBC, they result from the way SSL uses CBC. – CodesInChaos Feb 23 '14 at 9:33
Yes, you are right. But I think main reason of this problems is that CBC mode allows to influence the plaintext by changing the ciphertext. – neverwalkaloner Feb 23 '14 at 9:57
"which is pretty hard to implement. Older SSL versions also don't choose unpredictable IVs" So if I use only TLS 1.2 CBC is safe? – the_pwner224 Feb 23 '14 at 15:46
@the_pwner224 I don`t think so. Using unpredictable IV does not protect against timing attacks, as Lucky13. This attack applies to all TLS version. "The attack applies to all implementations that conform to TLS version 1.1 or 1.2, or DTLS version 1.0 or 1.1. It also applies to implementations of SSL 3.0 and TLS 1.0 that have countermeasures designed to defeat a previous padding oracle attack discovered several years ago. All TLS and DTLS ciphersuites that include CBC-mode encryption are potentially vulnerable." From document, which I link in my answer – neverwalkaloner Feb 23 '14 at 16:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.