2
$\begingroup$

I am looking at a wireshark capture of the cipher suites sent by my browser to the server during an SSL handshake; however, almost 90% of them use CBC, with 2 or 3 having GCM.

Why is CBC most used? Is there a specific property that makes CBC preferred by web communications?

Also literature suggests that the non-feedback modes (e.g., counter mode) perform better in practice; however GCM shows up in only a few cipher suites. Any ideas why?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
5
$\begingroup$

Historically, CBC was for long the dominant block cipher mode, but in recent years there's been a slow but firm move away from it, based on two trends:

  1. The move toward authenticated encryption as the "go-to" ciphers for practical applications;
  2. A reevaluation of the merits of CTR-based modes over CBC, driven by a variety of factors like:
    • The proliferation of attacks against CBC-based ciphersuites;
    • The simplicity and performance of CTR.

So you see a lot of CBC because it was the king for a long time, and it's only going away slowly. This blog entry by Cloudfare has graphs of the SSL cipher suites they're seeing and shows AES-GCM gradually gaining over AES-CBC.

Two references I've found useful:

Improve this answer
$\endgroup$
4
  • 4
    $\begingroup$ Backwards compatibility just rules the world ... $\endgroup$
    – SEJPM
    Commented Sep 30, 2016 at 19:08
  • 2
    $\begingroup$ Note that CCM, EAX and of course GCM use CTR mode underneath. $\endgroup$
    – Maarten Bodewes ♦
    Commented Sep 30, 2016 at 21:51
  • 2
    $\begingroup$ @MaartenBodewes: to be clear, that's what I meant when I said "CTR-based" instead of just "CTR." $\endgroup$
    – Luis Casillas
    Commented Sep 30, 2016 at 22:12
  • $\begingroup$ @LuisCasillas Well, that's nice once you know that many authenticated ciphers are based on CTR, but otherwise that's a pretty impossible connection to make. I just mentioned it because I thought that statement needed an example or two. And, in that sense, the note wasn't directed to you. $\endgroup$
    – Maarten Bodewes ♦
    Commented Sep 30, 2016 at 22:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.