# Explanation of openssl ciphersuites

I'm looking for a detailed explanation of the ciphersuites available in openssl.

openssl already offers the ciphers command which can be used to output, for example, the following:

\$ openssl ciphers -v "HIGH,-SHA,-AES256"
DH-DSS-AES128-GCM-SHA256 TLSv1.2 Kx=DH/DSS   Au=DH   Enc=AESGCM(128) Mac=AEAD
DHE-DSS-AES128-GCM-SHA256 TLSv1.2 Kx=DH       Au=DSS  Enc=AESGCM(128) Mac=AEAD
DH-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=DH/RSA   Au=DH   Enc=AESGCM(128) Mac=AEAD
DHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=DH       Au=RSA  Enc=AESGCM(128) Mac=AEAD
DHE-RSA-AES128-SHA256   TLSv1.2 Kx=DH       Au=RSA  Enc=AES(128)  Mac=SHA256
DHE-DSS-AES128-SHA256   TLSv1.2 Kx=DH       Au=DSS  Enc=AES(128)  Mac=SHA256
DH-RSA-AES128-SHA256    TLSv1.2 Kx=DH/RSA   Au=DH   Enc=AES(128)  Mac=SHA256
DH-DSS-AES128-SHA256    TLSv1.2 Kx=DH/DSS   Au=DH   Enc=AES(128)  Mac=SHA256
ADH-AES128-SHA256       TLSv1.2 Kx=DH       Au=None Enc=AES(128)  Mac=SHA256
AES128-GCM-SHA256       TLSv1.2 Kx=RSA      Au=RSA  Enc=AESGCM(128) Mac=AEAD
AES128-SHA256           TLSv1.2 Kx=RSA      Au=RSA  Enc=AES(128)  Mac=SHA256


It seems that ADH stands for "Anonymous Diffie-Hellman" but also implies specific groups and bit sizes.

I am interested in detailed explanations of what all the abbreviations are and generally which of these ciphersuites are considered secure.

Specifically:

1. What is ADH? Where is it standardized?
2. The listed MAC algorithms are hash functions. Is it using HMAC?
3. What does "Au" mean?
• A detailed explanation would have to cover: AES, GCM, SHA, DSS, RSA, ADH, DHE, TLS, Kx, Au, MAC, AEAD which would probably result in twelve paragraphs plus the asked security evaluation. This is too long IMO, can you be more focused please? – SEJPM Mar 21 '17 at 10:01
• @SEJPM Added more specific questions, I was originally hoping for a document or link with explanations for everything. ;) – Elias Mar 21 '17 at 10:32
• BTW it's silly to exclude HMAC-SHA1 suites as you do; they are not affected by 'SHAttered' and are not weaker than the HMAC-SHA256 suites. See my answer at security.stackexchange.com/a/152238/39571 – dave_thompson_085 Mar 22 '17 at 2:54
• @dave_thompson_085 I know, I made up a random cipher suite spec. Although, for global simplicity reasons, it might still be a good idea to just get rid of it everywhere. – Elias Mar 22 '17 at 9:12

What is ADH? Where is it standardized?

ADH stands for Anonymous Diffie-Hellman, ie unauthenticated Diffie-Hellman, also called "opportunistic encryption". It has been part of the SSL/TLS standards at least since SSLv3. It was also extended to ECDHE in RFC4492.

The listed MAC algorithms are hash functions. Is it using HMAC?

Yes indeed.

What does "Au" mean?

It most likely means something like Authentication mechanism. This clearly covers with the given ciphersuites as ADH suites have none there, RSA key-transport and DHE+RSA suites have RSA there (server authenticated via RSA signature), DHE+DSS suites have DSS there (server authenticated via DSA) and suites using static DH ones have DH there (server authenticated via his static DH public key).

• Note OpenSSL uses the spellings ADH and AECDH for what the standards (and many other implementations) call DH_anon and ECDH_anon. – dave_thompson_085 Mar 22 '17 at 2:49

Anonymous Diffie Hellman just means you don't use authentication for the key exchange along with Diffie Hellman. This also somehow answers your third question: Au stands for Authentication, as you can see whenever the suite uses ADH, Au is set to none. It isn't adviseable to use ADH in general.

As SHA256 itself is not a MAC, it uses some kind of MAC construction. AEAD stands for Authenticated Encryption with Associated Data. The Authenticated Encryption part tells you, the block mode (GCM in your examples) has message authentication built in.

Regarding the question of which of these ciphersuites are considered secure. That is hard to answer without knowing more about the environment, but this site and paper tries to give a general and practical answer.

• So ADH does not use authentication but the first A in AEAD stands for authenticated. So what is authenticated and what isn't in e.g. ADH-AES128-GCM-SHA256? – Elias Mar 21 '17 at 10:57
• There a two different places you can use authentication here, the key exchange, which is not authenticated with ADH is the first one. The second beeing message authentication of encrypted payload, which is included in the GCM mode of operation. I edited my answer to clarify this. – 0kp Mar 22 '17 at 0:49
• Au = Authentication
• Kx = Key Exchange
• Enc = Encrypt
• Mac = Message Authentication Code

For further details, see the OpenSSL documentation about ciphers.

• @Yagger Yu Please try to expand upon your answer. – Patriot Aug 4 '19 at 12:06
• Please also actually address the specific questions posed in the question. This answer currently only covers one of them ("what does Au mean") and just expanding the acronym might not be all too helpful to the asker. – SEJPM Aug 5 '19 at 11:40