TLS Cheatsheet

Sean Wright -

The purpose of this cheatsheet is to provide others with the relevant information which will help them to configure TLS on their servers to provide an adequate level of security.

TL;DR

If you want a quick and easy reference I would recommend the following.

Protocol

  • TLSv1.2

Key Exchange

  • ECHDE
  • ECDH

Symmetric Cipher

  • AES-256 (GCM mode)
  • AES-128 (GCM mode)
  • Camellia-256 (GCM mode)
  • Camellia-128 (GCM mode)

MAC

  • SHA256
  • SHA384
  • SHA512

Also worth keeping in mind that TLSv1.3 is just around the corner. I will update this list once it is supported by the common browsers and web servers.

Protocols

SSL is dead! Under not circumstances use SSL. You should only be using TLS In terms of which versions, you should ideally be using TLSv1.2 and above (TLSv1.3 is about to be out very soon).

SSL

SSL is no longer considered secure and should not be used. The most recent vulnerability in the protocol is POODLE and this was the final nail in the coffin for this protocol.

TLS

TLSv1.0 is vulnerable to the BEAST attack, although this has been largely mitigated by client side mitigations. Some implementations of TLSv1.0 as well as TLSv1.1 are also vulnerable to POODLE.

Key Exchanges

Stick with ECDH (Elliptic-curve Diffie–Hellman) and ECDHE (Elliptic-curve Diffie–Hellman Ephemeral).

RSA

If you can, avoid using RSA (Rivest–Shamir–Adleman) since it may be vulnerable to the ROBOT attck, and the fact that RSA does not allow for Perfect Forward Secrecy.

DH/DHE

Both the DH (Diffie–Hellman) and DHE (Diffie–Hellman Ephemeral) key exchange algorithms are vulnerable to the LogJam attack.

ECDH/ECHDE

You should stick with ECDH and ECDHE, since these both do not have any known vulnerabilities at this point in time. ECHDE enables perfect forward secrecy, so cipher suites with this key exchange should be at the top of your cipher list.

Symmetric Ciphers

DES and 3DES

Both are broken and should not be used. 3DES is vulnerable to the the Sweet32 attack.

RC4

RC4 has numerous vulnerabilities, most notably the Bar-mitzvah attack and the NOMORE attack.

AES (CBC)

The CBC mode of operation in AES is vulnerable to the Lucky 13 attack.

MAC

MD

All MD MAC algorithms are no longer secure and should no longer be used.

SHA

SHA(1) has been proven to be prone to hash collisions. There is a debate whether this has a significant impact on TLS connections. Personally I prefer to not support it and instead support SHA2 and above.