1
$\begingroup$

I've been researching some of the types of encryption that the python SSL library uses.

Among them the best I've seen are:

  1. ECDHE-RSA-AES256-GCM-SHA384

    • TLSv1.2
    • Kx = ECDH
    • Au = RSA
    • Enc = AESGCM (256)
    • Mac = AEAD
  2. ECDHE-ECDSA-AES256-GCM-SHA384

    • TLSv1.2
    • Kx = ECDH
    • Au = ECDSA
    • Enc = AESGCM (256)
    • Mac = AEAD
  3. TLS_AES_256_GCM_SHA384

    • TLSv1.3
    • Kx = any
    • Au = any
    • Enc = AESGCM (256)
    • Mac = AEAD

I have sorted the encryption types according to their level of security, efficiency, and use. (Based on what you can research online, they are the most used and safest, especially the first).

The truth is that I don't know which one to choose for my project.

I would appreciate being guided and advised on which one to choose.

$\endgroup$
  • 1
    $\begingroup$ It depends on your environment. Will you use mutual authentication? One-sided with weak clients? Do you only have very limited bandwidth? Do you have to interoperate with other (potentially old) TLS libraries? $\endgroup$ – SEJPM Jan 4 at 15:41
  • $\begingroup$ What is your aim? if you searched than at least you can say, these part of 1 is good for your project and not that part, etc. Otherwise, It is a bullet to the air. $\endgroup$ – kelalaka Jan 4 at 17:21
  • $\begingroup$ I am creating a private chat room with python, and that is why I seek to give the best security to the data, as these come and go from a server. @ kelalakaThe ssl library seemed like a good option, but as you can see I have these three options and I don't know which one to choose, to have the best possible security and performance. $\endgroup$ – Carlos Andrés Bello Jan 4 at 21:29
  • $\begingroup$ @SEJPM If with mutual authentication you mean that both client and server certify each other to verify that everything is going well, because if it would be good, since I have read that it provides more security, and in terms of bandwidth, for now it is not The best, but not bad either. Over time I will improve that part. $\endgroup$ – Carlos Andrés Bello Jan 4 at 21:31
3
$\begingroup$

You may need a 1.2 and 1.3 scheme, so I'd include at least one of both, giving priority to 1.3 as it is the latest / greatest protocol.

Then there is ECDSA and RSA, indicating the certificate based authentication used. ECDSA is more performant for similar security (and you may not even get any certificates above RSA-4096). That may be important if you can choose the certificate type. However, once you've chosen your TLS certificate type, you don't get to choose between the two cipher-suites, and you just include the one that is compatible with your certificate.

If you do Business-to-Business (B2B) then I'd choose TLS 1.3 due to the fast session resumption may achieve.

| improve this answer | |
$\endgroup$
  • $\begingroup$ which one to prefer between ECDSA and RSA and why? $\endgroup$ – Carlos Andrés Bello Jan 4 at 21:33
  • 1
    $\begingroup$ RSA has a slight advantage maybe when it comes to protection against Quantum Computers, but I'd go for ECDSA otherwise as it scales better wrt performance and keysize for a high level of security. $\endgroup$ – Maarten Bodewes Jan 4 at 22:18
1
$\begingroup$

Whenever TLS is being configured for a new scenario or application, we must identify a balance between security and usability. With that said, I do not believe it's the best approach to only enable strictly only TLS 1.3 yet, since it's still a fairly new protocol, and can cause interoperability issues with older services that you may have to connect the application to.

Either option 1) or 2) are secure and will not present interoperability issues for most scenarios, also ECDHE is supported for all 3 options, which means PFS (perfect forward secrecy) is supported by the cipher suite.

| improve this answer | |
$\endgroup$
  • $\begingroup$ Pineso the same, but as I told @Maarten - reinstall Monica Between ECDSA and RSA which is the most used and also provides greater security? $\endgroup$ – Carlos Andrés Bello Jan 4 at 21:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.