4
$\begingroup$

Which block cipher mode of operation does TLS 1.3 use? I assume it is a block cipher mode that provides authentication (like GCM).

$\endgroup$
3
  • $\begingroup$ Which version are we talking about? $\endgroup$
    – kelalaka
    Commented Oct 15, 2021 at 10:12
  • $\begingroup$ Latest - TLS 1.3 $\endgroup$ Commented Oct 15, 2021 at 13:27
  • 1
    $\begingroup$ Hi Yotam. A few hints: you may receive downvotes if the standard directly specifies what you are looking for; replicating all information in the standard is generally not considered useful - especially since RFC's are freely available. If you have additional information, e.g. after a comment then please edit them into your question instead of using comments (you may want to comment to notify the requester though). $\endgroup$
    – Maarten Bodewes
    Commented Oct 15, 2021 at 15:23

2 Answers 2

17
$\begingroup$

TLS 1.3 has huge clean up after failures. We have only 5 cipher suites in TLS 1.3, with their IDs:

  • {0x13,0x01} - TLS_AES_256_GCM_SHA384
  • {0x13,0x02} - TLS_CHACHA20_POLY1305_SHA256
  • {0x13,0x03} - TLS_AES_128_GCM_SHA256
  • {0x13,0x04} - TLS_AES_128_CCM_8_SHA256
  • {0x13,0x05} - TLS_AES_128_CCM_SHA256

As of current RFC 8446:

A TLS-compliant application MUST implement the TLS_AES_128_GCM_SHA256 [GCM] cipher suite and SHOULD implement the TLS_AES_256_GCM_SHA384 [GCM] and TLS_CHACHA20_POLY1305_SHA256 [RFC8439] cipher suites

All of these cipher suites are using CTR mode, AES is Pseudo-Random Permutation (PRP), and Chacha20 is Pseudo-Random Function (PRF); as a result, ChaCha20 is better for CTR mode like any PRF.

AES-256 is the golden standard and approved by NIST and it is Quantum secure (Grover's algorithm) (ChaCha secure against QC, too). AES has CPU instruction known as Intel's AES-NI. Intel also added PCLMULQDQ instruction as of 2014 to increase the GCM's performance, therefore we will see it more than the others.

  • GCM (Galois Counter Mode) is the most used one*.
  • CCM is a preferred mode constrained environments.
  • ChaCha20-Poly1305 is preferred by Google and it is immune to timing attacks by design.

Note that, in software, ChaCha20 beats AES and this is not a surprise since it is designed to be CPU-friendly.


*GCM is hard to use correctly, there are many pitfalls.

$\endgroup$
7
$\begingroup$

TLS permits a very long list of cipher suites. Not every implementation will support every cipher suite. Every implementation of TLS 1.3 is required to implement AES-128-GCM-SHA256, with AES-256-GCM-SHA384 and CHACHA20-Poly1305-SHA256 encouraged. Note that ChaCha20 usually just operates as a stream cipher, so it doesn't require a block mode.

Which cipher is actually used by your connection will depend on the configuration of the two peers, but it should always be possible to settle on one of the mandatory suites. Usage statistics show that the most common usage is AES256-GCM-SHA384.

$\endgroup$
6
  • 3
    $\begingroup$ rfc8446.html#section-9.1: A TLS-compliant application MUST implement the TLS_AES_128_GCM_SHA256 [GCM] cipher suite and SHOULD implement the TLS_AES_256_GCM_SHA384 [GCM] and TLS_CHACHA20_POLY1305_SHA256 [RFC8439] cipher suites (see $\endgroup$
    – kelalaka
    Commented Oct 15, 2021 at 11:10
  • $\begingroup$ @kelalaka Many thanks. I have edited the answer accordingly. $\endgroup$
    – Daniel S
    Commented Oct 15, 2021 at 12:08
  • $\begingroup$ Nearly all of the long list of ciphersuites are for 1.2, or lower in many but not all cases, not 1.3. 1.3 can only use the suites defined (newly) for it. (Though a ClientHello that offers both 1.3 and lower can and should have both types of suites in its list.) $\endgroup$ Commented Oct 15, 2021 at 22:25
  • $\begingroup$ @dave_thompson_085 True, but the original question did not stipulate 1.3. I don’t know if 1.3 adoption is still depressingly slow but a lot of those ciphers could still be out there. $\endgroup$
    – Daniel S
    Commented Oct 15, 2021 at 22:35
  • $\begingroup$ @dave_thompson_085 I've changed the question asked to OP, then according to answer, modified the question. Without it, it was to brood. $\endgroup$
    – kelalaka
    Commented Oct 16, 2021 at 14:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.