I've been trying to evaluate the security of a list of cipher suites and I've come across cipher suites, not explicitly featuring a mode of operation.

Form this list (openvpn --show-tls), one of such cipher suites would be:


As the cipher suites are provided by the underlying SSL library (OpenSSL 1.0.2g), I assume there must be a default mode, if not explicitly defined.

What mode would be used in this case?


1 Answer 1


If you look at the official list, you'll see that the official cipher suite name always has the mode explicitly stated; each AES-based transform is explicitly called out to be CBC, GCM or CCM.

Going through the OpenSSL source code, we find that the ciphersuite you cited has the value 0x00, 0x37, that is, TLS_DH_RSA_WITH_AES_256_CBC_SHA. Hence, CBC is the mode being implicit. I suspect this is implicit because OpenSSL predates TLS 1.2; in TLS 1.1 and prior, CBC was the only block cipher mode allowed (and hence there was no need to call it out); once the started supporting TLS 1.2, they didn't feel like they should go back and modify the name strings they used for existing ciphersuites.

  • 2
    $\begingroup$ A more convenient reference than the source code is about 2/3 of the way down the man page for ciphers(1) on your system or on the web $\endgroup$ Jul 20, 2017 at 2:57
  • $\begingroup$ Thank you very much for the informative answer, as well as the complimentary link @dave_thompson_085 $\endgroup$
    – SaAtomic
    Jul 20, 2017 at 4:53
  • $\begingroup$ @dave_thompson_085: Nice. Didn't know that. But I prefer testssl's mapping: testssl.sh/openssl-rfc.mapping.html $\endgroup$ Jul 21, 2017 at 8:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.