What key exchange do OpenSSL and CryptoAPI prefer by default?

Question

Here is what I know.

When I connect to a brand-new Linux Web server with Chrome and click the "lock" icon, the key exchange algorithm is described as "ECDHE_RSA". (Yes I know what that is.)

When I connect with Internet Explorer 8 on Windows 7, the key exchange is described as "RSA with 2048 bit exchange". I know what that is, too.

With Firefox, it says I am secured by "AES-256, 256 bit keys". Which is (a) redundant and (b) tells me nothing about the key exchange algorithm.

When I run openssl ciphers on my brand-new Linux machine, the output starts with:

ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:...

(I suspect these are listed in order of OpenSSL's preference, but I do not know where this is documented.)

ECDHE stands for "elliptic curve Diffie-Hellman, ephemeral". That's great, but I want to know the actual key exchange algorithm, including the specific elliptic curve.

Here is what I really want: A big table, containing all possible pairs of SSL client and server (all versions), telling me what specific key exchange algorithm (including the actual elliptic curve) would be negotiated between them. Or enough information to construct that table.

I would settle for simply knowing how the latest versions of OpenSSL and CryptoAPI behave by default, and where this is documented.

Answer 1

Given a SSL-enabled web site, the Qualys SSL tester will tell what ciphersuite would be negotiated by a bunch of different browsers if they connected to that web site. It will also tell you the list of ciphersuites supported by that server and the list of ciphersuites are supported by each of those major browsers.

For example, here is the output for one web site you mentioned elsewhere: output. The section labelled "Handshake Simulation" will tell you what cipher suite many different major browsers would negotiate with this server. For instance:

• Chrome 29 (Win 7) would negotiate TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA over TLS 1.2;

• IE 8 (Win 7) would negotiate TLS_RSA_WITH_AES_128_CBC_SHA over TLS 1.0 (which does not provide forward secrecy);

• Firefox 22 (Win 7) would negotiate TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA over TLS 1.0;

and so on. This doesn't tell you what elliptic curve they would use or the key size, but it gives you the other information you were looking for.

By testing one representative web site for each possible SSL server, you should be able to get close to the grid you want of the key exchange algorithm negotiated by all (browser, server) pairs.