I've been tasked with defining a list of cipher suites to use.

The requirements for the cipher suites are the following:

  • Symmetric Algorithm: AES-256
  • Key Exchange: ECDH P-384, DH 3072-bit, RSA 3072-bit
  • Key Authentication: ECDSA P-384, RSA 3072-bit
  • Hash Algorithm: SHA-384

Here is the list I've come up with (in prioritized order):

  2. TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 (0x00C024)
  3. TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0x00C030)
  4. TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0x00C028)
  5. TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (0x00009F)
  6. TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 (0x00C02E)
  7. TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 (0x00C026)
  8. TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 (0x00C032)
  9. TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 (0x00C02A)
  10. TLS_RSA_WITH_AES_256_GCM_SHA384 (0x00009D)
  11. TLS_DH_RSA_WITH_AES_256_GCM_SHA384 (0x0000A1)

Would you say I've made the correct prioritization of the cipher suites? Are any of these ciphers considered weak?

  • 3
    $\begingroup$ Uhm, why do you prioritize CBC over GCM? $\endgroup$ – SEJPM Mar 15 '17 at 16:41
  • 1
    $\begingroup$ I'd say [1] prefer GCM over CBC, [2] prefer ECDHE over ECDH over DH [3] prefer ECDSA over RSA. $\endgroup$ – puzzlepalace Mar 15 '17 at 17:41
  • $\begingroup$ @SEJPM, looks like a typo. 0x00C02C uses GCM. 4ndr345 , could you clarify? $\endgroup$ – otus Mar 15 '17 at 18:27
  • $\begingroup$ @otus A typo indeed. Edited the question to correct the mistake. $\endgroup$ – 4ndr345 Mar 15 '17 at 18:38
  • $\begingroup$ @puzzlepalace In regards to Key exchange, would you prefer DHE over ECDH or the other way around? And where would you rate RSA in there? $\endgroup$ – 4ndr345 Mar 15 '17 at 18:46

These are all fine and the order seems reasonable as well. It is a judgement call which part you think is most likely to fail. I would use your order of preference for the elliptic curve algorithms. GCM vs. CBC is a case of which you find more likely to be badly implemented.

If the requirements are not enforced upon you, I would consider adding in P-256. It should be as strong as 3072-bit RSA, and it at least used to be slightly more widely supported than P-384 – I have not seen recent numbers though.

| improve this answer | |
  • $\begingroup$ Thanks for the response. I've decided to scrap most of the non-ephemeral ciphers as all services I have tested against that support these options also supports the ephemeral variants. I've also removed DHE as the services that will implement this list does not support DHE > 1024/2048 (my requirement is 3072). Here's my final list (in prioritized order): TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 TLS_RSA_WITH_AES_256_GCM_SHA384 $\endgroup$ – 4ndr345 Mar 17 '17 at 17:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.