“Which SSL ciphers should I disable?”
Influenza A virus subtype H5N1 customer late gave me a listing of their supported ciphers too asked me which SSL ciphers they should disable – effectively looking for the most secure SSL ciphers they tin sack use. Instead of the fast response of “disable the insecure ones”, I idea I’d examine too write upward something useful.
So here’s a handy reference guide I’m working on. This has been fourth dimension consuming to educate too no incertitude volition endure added to over time. This isn’t intended to endure read from start-to-finish, but is to a greater extent than of a handy SSL/TLS number cheat-sheet.
Got a vulnerability to add, noticed an inaccuracy, got a novel reference? Message me!
CVE-2016-0800, or Decrypting RSA amongst Obsolete too Weakened eNcryption (DROWN), is a vulnerability that affects servers soundless supporting SSLv2 or servers that part a someone primal amongst whatever other server that allows SSLv2 (even for other protocols such every bit email). It allows an assaulter who has an effective man-in-the-middle to intermission the encryption of a TLS connectedness inwards nether 8 hours amongst a variant beingness achievable inwards one minute. The assail takes many hundreds of requests which tin sack endure achieved yesteryear the user visiting a charge intensive application or alternatively beingness coerced inwards to visiting a site which tin sack brand a large number of cross-site requests. The target application tin sack usage whatever protocol suite including TLSv1.2 every bit long every bit the requirement for SSLv2 is too met, additionally RSA primal central must endure used. This number tin sack endure combined with CVE-2015-3197 which is an OpenSSL vulnerability that allows SSLv2 connections to endure made fifty-fifty inwards no SSLv2 ciphers are enabled.
References
https://drownattack.com/
https://drownattack.com/drown-attack-paper.pdf
CRIME
Compression Ratio Info-leak Made Easy (CRIME) is an assail against TLS/SSL, but it has a much smaller probability of exploitation. The authors of CRIME too wrote the BEAST attack. The assaulter requires a man-in-the-middle connectedness too the mightiness to repeatedly inject predictable information whilst monitoring the resulting encrypted traffic. This could endure achievable through Cross-site scripting attacks; JavaScript is non required too an assail could endure possible amongst HTML Injection lonely withal it would endure less efficient.
For CRIME to endure possible the customer too server must back upward compression of the asking earlier encryption. TLS supports DEFLATE which is vulnerable, every bit is SPDY.
References
https://www.gracefulsecurity.com/crime-against-tls/
BEAST
Browser Exploit Against SSL/TLS (BEAST) is a practical assail was found to endure possible against TLS v1.0 too SSLv3.0 (and below) when a block cipher is inwards use. Effectively an assaulter is able to decide the Initialisation Vector utilised every bit piece of job of the encryption procedure pregnant that if a repeating blueprint is evident inwards the plaintext too so it volition endure evident inwards the ciphertext. However, it is of express usage an it is only possible to call upward little pieces of data, such every bit session tokens. The assaulter must endure able to man-in-the-middle a connectedness too at that spot must endure a means of generating additional traffic such every bit an SOP bypass or a Cross-site Scripting vulnerability. The user must endure using an older spider web browser, every bit modern browsers protect against this issue. If all of these atmospheric condition are met too session tokens are protected against XSS through a mechanisms such every bit HttpOnly cookies too so an assaulter may exploit BEAST to arrive at access to these protected tokens.
Remediation
Enforce TLS v1.1 too above
Alternatively yous could convey the conduct chances too rely on the protections offered yesteryear modern browsers, or alternatively prefer RC4 ciphers to mitigate animate beingness but innovate their ain issues.
References
https://www.gracefulsecurity.com/what-is-beast/
BREACH
CVE-2013-3587, or Browser Reconnaissance too Exfiltration via Adaptive Compression of Hypertext (BREACH) is an instance of CRIME against HTTP Compression. That is to order that CRIME attacked TLS SPDY whereas BREACH targets HTTP gzip/DEFLATE. Therefore turning off the TLS compression has no touching on BREACH every bit it exploits the underlying HTTP compression. The assail follows the basic steps of the CRIME assail too at that spot are several methods to remediate the issue, such every bit disabling HTTP compression, protecting the application from CSRF attacks, randomising CSRF tokens per asking to forestall them beingness captured, obfuscating the length of page responses yesteryear adding random amounts of arbitrary bytes to the response.
References
https://bugzilla.redhat.com/show_bug.cgi?id=995168
FREAK
CVE-2015-0204, CVE-2015-1637, CVE-2015-1067, or Factoring RSA Keys (FREAK), is a vulnerability that allows an positioned assaulter amongst a man-in-the-middle assail to cut back the safety offered yesteryear SSL/TLS yesteryear forcing a connectedness to usage “Export-grade” grade encryption – which reduces the RSA strength to 512 bits, which is breakable yesteryear attackers amongst a little budget (In 2015 researchers showed this to endure nearly $104 on Amazon EC2 instances). However breaking keys is soundless computationally expensive too slow, withal an assaulter may non require to intermission a primal for every session due to implementation details – for instance amongst Apache mod_ssl a unmarried primal was generated at kicking fourth dimension too used for all connections. Export-grade refers to USA police describe which restricted the usage of rigid cryptography.
References
https://blog.cryptographyengineering.com/2015/03/03/attack-of-week-freak-or-factoring-nsa/
Logjam
CVE-2015-4000, or “Logjam”, is a vulnerability which affects TLSv1.2 too below which allows a man-in-the-middle assaulter to downgrade the encryption to 512-bit export grade cryptography, which is breakable yesteryear attackers amongst a little budget (In 2015 researchers showed this to endure nearly $104 on Amazon EC2 instances).
References
https://weakdh.org/
https://weakdh.org/imperfect-forward-secrecy-ccs15.pdf
NOMORE
Numerous Occurrence MOnitoring & Recovery Exploit, or “RC4 NOMORE”, is a practical assail against RC4 which allows a HTTP Cookie to endure retreived inside 52 hours, given an effective man-in-the-middle attack. The developers of the NOMORE assail too noted at that spot were several optimisations that could endure made to their piece of job to farther cut back this time.
References
https://www.rc4nomore.com/
Bar Mitzvah
CVE-2015-2808, or “Bar Mitzvah”, relates to a vulnerability known every bit the Invariance Weakness which allows for little amounts of plaintext information to endure recovered from an SSL/TLS session protected using the RC4 cipher.The assail was described at Blackhat Asia 2015. It requires a positioned assaulter amongst a man-in-the-middle assail capable of capturing “many millions” of requests. This vulnerability allows a positioned assaulter to recover the to the lowest degree important chip of every bit many every bit 100 bytes from the encrypted stream.
References
https://www.blackhat.com/docs/asia-15/materials/asia-15-Mantin-Bar-Mitzvah-Attack-Breaking-SSL-With-13-Year-Old-RC4-Weakness-wp.pdf
SWEET32
CVE-2016-2183, or “SWEET32”, relates to a birthday assail against 64-bit block ciphers such every bit DES too 3DES. It requires a positioned assaulter amongst a man-in-the-middle assail capable of capturing a long-lived HTTPS connection. The master proof of concept showed that it was possible to recover secure HTTP cookies yesteryear capturing roughly 785 GB of traffic, yesteryear generating traffic through malicious JavaScript. Effectively therefore, this vulnerability allows a positioned assaulter to bypass the protections offered yesteryear the “secure” flag on cookies when used inwards conjunction amongst a vulnerability such every bit a SOP bypass or Cross-site Scripting.
https://sweet32.info/
https://www.openssl.org/blog/blog/2016/08/24/sweet32/
SSL POODLE
CVE-2014-3566, SSL Padding Oracle On Downgraded Legacy Encryption Vulnerability (POODLE) is a vulnerability affecting SSLv3 where a block cipher is enabled utilizing the CBC cipher mode. It requires a man-in-the-middle assail too the mightiness for the assaulter to drive the application to send the same information over newly created SSL3.0 connections but allows an assaulter to decipher a chosen byte of cipher text inwards every bit few every bit 256 attempts. This vulnerability is an number inwards the specification non a specific implementation issue. Additionally if a service prefers TLS over SSLv3 it may endure possible to ‘roll back’ the connect if the TLS Fallback SCSV machinery is non enabled.
References
https://www.imperialviolet.org/2014/10/14/poodle.html
TLS POODLE
CVE-2014-8730, TLS Padding Oracle On Downgraded Legacy Encryption Vulnerability (POODLE) is a vulnerability affecting sure as shooting implementations of TLS. Originally the assail was described against SSLv3 although later on expanded amongst sure as shooting limitations. This vulnerability is implementation specific, but known to touching F5 products.
References
https://www.imperialviolet.org/2014/12/08/poodleagain.html
https://support.f5.com/csp/#/article/K15882
Heartbleed
CVE-2014-0160, or “Heartbleed”, is non an number inwards SSL/TLs specifically, but instead was an implementation number in OpenSSL affecting versions 1.0.1 through 1.0.1f. It tin sack endure fixed either through upgrading to a to a greater extent than recent version of OpenSSL or alternatively compiling amongst the option -DOPENSSL_NO_HEARTBEATS. It does non require a Man-in-the-Middle to exploit too tin sack endure exploited against both the server too the client. The number allows an assaulter to extract upward to 64kb of retentiveness from the vulnerable system, which tin sack atomic number 82 to the theft of credentials, session tokens too server someone keys.
References
http://heartbleed.com/
RC2 ciphers are considered to offering solely a depression amount of safety every bit their primal length. Low strength ciphers are considered to endure those amongst a primal length <= 64-bits.
RC4
RC4 ciphers are known to endure vulnerable to a number of issues such every bit the “Invariance Weakness” start described inwards 2001. Several attacks cause got been discussed, such every bit the “Bar Mitzvah attack” demonstrated at Blackhat Asia 2015. This algorithm is too referred to every bit ARC4 or ARCFOUR (for Alleged RC4) inwards some contexts due to the term RC4 beingness trademarked. The most notable assail is probable the RC4 NOMORE assail which tin sack recover a TLS protected HTTP cookie inwards every bit footling every bit 52 hours.
DES
DES is a 64-bit block cipher too is hence affected yesteryear the “SWEET32” vulnerability described inwards CVE-2016-2183.
Additionally it is marked every bit a “Medium” strength cipher which is below the recommended level. Medium strength ciphers are those amongst a primal length at to the lowest degree 56 bits too less than 112 bits.
3DES
3DES uses a 64-bit block cipher too is hence affected yesteryear the “SWEET32” vulnerability described inwards CVE-2016-2183.
NULL
The NULL cipher suites exactly inform the browser non to encrypt data, hence effectively nullifying whatever protection given through the usage of SSL/TLS.
Both Microsoft too Google cause got announced that it is inappropriate to use. Microsoft, when speaking nearly SSL/TLS for HTTPS noted dorsum inwards 2013 that they volition no longer endure supporting SHA1 every bit a safety algorithm yesteryear 2016. Google had a similar proclamation stating they volition endure penalising companies for using SHA1 during 2016 too no longer supporting it post-2016 – that announcement and a footling farther information is available here: https://security.googleblog.com/2014/09/gradually-sunsetting-sha-1.html. Microsoft too published the next article which shows displace towards deprecation inwards Internet Explorer too Edge: https://blogs.windows.com/msedgedev/2016/11/18/countdown-to-sha-1-deprecation/#Jeb54DCIEtIIcY4r.97
References
https://blogs.windows.com/msedgedev/2016/11/18/countdown-to-sha-1-deprecation/#Jeb54DCIEtIIcY4r.97
https://security.googleblog.com/2014/09/gradually-sunsetting-sha-1.html
Certificate amongst Wrong Hostname
If the Common Name does non fit the hostname of the server too so a user may non endure able to decide if the certificate is for that service or not, this mostly results inwards a safety mistake inside spider web browsers too requires the user to “click through” the message to stance the application. This would too forestall a user from visiting the application if HSTS is enabled. This would probable require some flat of social applied scientific discipline to endure useful to an assaulter attempting to man-in-the-middle a connection, withal users may endure used to clicking through the mistake message when visiting this service too hence non let on the illegitimate certificate.
Influenza A virus subtype H5N1 customer late gave me a listing of their supported ciphers too asked me which SSL ciphers they should disable – effectively looking for the most secure SSL ciphers they tin sack use. Instead of the fast response of “disable the insecure ones”, I idea I’d examine too write upward something useful.
So here’s a handy reference guide I’m working on. This has been fourth dimension consuming to educate too no incertitude volition endure added to over time. This isn’t intended to endure read from start-to-finish, but is to a greater extent than of a handy SSL/TLS number cheat-sheet.
Got a vulnerability to add, noticed an inaccuracy, got a novel reference? Message me!
Vulnerabilities
DROWNCVE-2016-0800, or Decrypting RSA amongst Obsolete too Weakened eNcryption (DROWN), is a vulnerability that affects servers soundless supporting SSLv2 or servers that part a someone primal amongst whatever other server that allows SSLv2 (even for other protocols such every bit email). It allows an assaulter who has an effective man-in-the-middle to intermission the encryption of a TLS connectedness inwards nether 8 hours amongst a variant beingness achievable inwards one minute. The assail takes many hundreds of requests which tin sack endure achieved yesteryear the user visiting a charge intensive application or alternatively beingness coerced inwards to visiting a site which tin sack brand a large number of cross-site requests. The target application tin sack usage whatever protocol suite including TLSv1.2 every bit long every bit the requirement for SSLv2 is too met, additionally RSA primal central must endure used. This number tin sack endure combined with CVE-2015-3197 which is an OpenSSL vulnerability that allows SSLv2 connections to endure made fifty-fifty inwards no SSLv2 ciphers are enabled.
References
https://drownattack.com/
https://drownattack.com/drown-attack-paper.pdf
CRIME
Compression Ratio Info-leak Made Easy (CRIME) is an assail against TLS/SSL, but it has a much smaller probability of exploitation. The authors of CRIME too wrote the BEAST attack. The assaulter requires a man-in-the-middle connectedness too the mightiness to repeatedly inject predictable information whilst monitoring the resulting encrypted traffic. This could endure achievable through Cross-site scripting attacks; JavaScript is non required too an assail could endure possible amongst HTML Injection lonely withal it would endure less efficient.
For CRIME to endure possible the customer too server must back upward compression of the asking earlier encryption. TLS supports DEFLATE which is vulnerable, every bit is SPDY.
References
https://www.gracefulsecurity.com/crime-against-tls/
BEAST
Browser Exploit Against SSL/TLS (BEAST) is a practical assail was found to endure possible against TLS v1.0 too SSLv3.0 (and below) when a block cipher is inwards use. Effectively an assaulter is able to decide the Initialisation Vector utilised every bit piece of job of the encryption procedure pregnant that if a repeating blueprint is evident inwards the plaintext too so it volition endure evident inwards the ciphertext. However, it is of express usage an it is only possible to call upward little pieces of data, such every bit session tokens. The assaulter must endure able to man-in-the-middle a connectedness too at that spot must endure a means of generating additional traffic such every bit an SOP bypass or a Cross-site Scripting vulnerability. The user must endure using an older spider web browser, every bit modern browsers protect against this issue. If all of these atmospheric condition are met too session tokens are protected against XSS through a mechanisms such every bit HttpOnly cookies too so an assaulter may exploit BEAST to arrive at access to these protected tokens.
Remediation
Enforce TLS v1.1 too above
Alternatively yous could convey the conduct chances too rely on the protections offered yesteryear modern browsers, or alternatively prefer RC4 ciphers to mitigate animate beingness but innovate their ain issues.
References
https://www.gracefulsecurity.com/what-is-beast/
BREACH
CVE-2013-3587, or Browser Reconnaissance too Exfiltration via Adaptive Compression of Hypertext (BREACH) is an instance of CRIME against HTTP Compression. That is to order that CRIME attacked TLS SPDY whereas BREACH targets HTTP gzip/DEFLATE. Therefore turning off the TLS compression has no touching on BREACH every bit it exploits the underlying HTTP compression. The assail follows the basic steps of the CRIME assail too at that spot are several methods to remediate the issue, such every bit disabling HTTP compression, protecting the application from CSRF attacks, randomising CSRF tokens per asking to forestall them beingness captured, obfuscating the length of page responses yesteryear adding random amounts of arbitrary bytes to the response.
References
https://bugzilla.redhat.com/show_bug.cgi?id=995168
FREAK
CVE-2015-0204, CVE-2015-1637, CVE-2015-1067, or Factoring RSA Keys (FREAK), is a vulnerability that allows an positioned assaulter amongst a man-in-the-middle assail to cut back the safety offered yesteryear SSL/TLS yesteryear forcing a connectedness to usage “Export-grade” grade encryption – which reduces the RSA strength to 512 bits, which is breakable yesteryear attackers amongst a little budget (In 2015 researchers showed this to endure nearly $104 on Amazon EC2 instances). However breaking keys is soundless computationally expensive too slow, withal an assaulter may non require to intermission a primal for every session due to implementation details – for instance amongst Apache mod_ssl a unmarried primal was generated at kicking fourth dimension too used for all connections. Export-grade refers to USA police describe which restricted the usage of rigid cryptography.
References
https://blog.cryptographyengineering.com/2015/03/03/attack-of-week-freak-or-factoring-nsa/
Logjam
CVE-2015-4000, or “Logjam”, is a vulnerability which affects TLSv1.2 too below which allows a man-in-the-middle assaulter to downgrade the encryption to 512-bit export grade cryptography, which is breakable yesteryear attackers amongst a little budget (In 2015 researchers showed this to endure nearly $104 on Amazon EC2 instances).
References
https://weakdh.org/
https://weakdh.org/imperfect-forward-secrecy-ccs15.pdf
NOMORE
Numerous Occurrence MOnitoring & Recovery Exploit, or “RC4 NOMORE”, is a practical assail against RC4 which allows a HTTP Cookie to endure retreived inside 52 hours, given an effective man-in-the-middle attack. The developers of the NOMORE assail too noted at that spot were several optimisations that could endure made to their piece of job to farther cut back this time.
References
https://www.rc4nomore.com/
Bar Mitzvah
CVE-2015-2808, or “Bar Mitzvah”, relates to a vulnerability known every bit the Invariance Weakness which allows for little amounts of plaintext information to endure recovered from an SSL/TLS session protected using the RC4 cipher.The assail was described at Blackhat Asia 2015. It requires a positioned assaulter amongst a man-in-the-middle assail capable of capturing “many millions” of requests. This vulnerability allows a positioned assaulter to recover the to the lowest degree important chip of every bit many every bit 100 bytes from the encrypted stream.
References
https://www.blackhat.com/docs/asia-15/materials/asia-15-Mantin-Bar-Mitzvah-Attack-Breaking-SSL-With-13-Year-Old-RC4-Weakness-wp.pdf
SWEET32
CVE-2016-2183, or “SWEET32”, relates to a birthday assail against 64-bit block ciphers such every bit DES too 3DES. It requires a positioned assaulter amongst a man-in-the-middle assail capable of capturing a long-lived HTTPS connection. The master proof of concept showed that it was possible to recover secure HTTP cookies yesteryear capturing roughly 785 GB of traffic, yesteryear generating traffic through malicious JavaScript. Effectively therefore, this vulnerability allows a positioned assaulter to bypass the protections offered yesteryear the “secure” flag on cookies when used inwards conjunction amongst a vulnerability such every bit a SOP bypass or Cross-site Scripting.
DES-CBC3-SHAReferences
https://sweet32.info/
https://www.openssl.org/blog/blog/2016/08/24/sweet32/
SSL POODLE
CVE-2014-3566, SSL Padding Oracle On Downgraded Legacy Encryption Vulnerability (POODLE) is a vulnerability affecting SSLv3 where a block cipher is enabled utilizing the CBC cipher mode. It requires a man-in-the-middle assail too the mightiness for the assaulter to drive the application to send the same information over newly created SSL3.0 connections but allows an assaulter to decipher a chosen byte of cipher text inwards every bit few every bit 256 attempts. This vulnerability is an number inwards the specification non a specific implementation issue. Additionally if a service prefers TLS over SSLv3 it may endure possible to ‘roll back’ the connect if the TLS Fallback SCSV machinery is non enabled.
References
https://www.imperialviolet.org/2014/10/14/poodle.html
Any SSLv3 block cipher amongst CBC
TLS POODLE
CVE-2014-8730, TLS Padding Oracle On Downgraded Legacy Encryption Vulnerability (POODLE) is a vulnerability affecting sure as shooting implementations of TLS. Originally the assail was described against SSLv3 although later on expanded amongst sure as shooting limitations. This vulnerability is implementation specific, but known to touching F5 products.
References
https://www.imperialviolet.org/2014/12/08/poodleagain.html
https://support.f5.com/csp/#/article/K15882
Heartbleed
CVE-2014-0160, or “Heartbleed”, is non an number inwards SSL/TLs specifically, but instead was an implementation number in OpenSSL affecting versions 1.0.1 through 1.0.1f. It tin sack endure fixed either through upgrading to a to a greater extent than recent version of OpenSSL or alternatively compiling amongst the option -DOPENSSL_NO_HEARTBEATS. It does non require a Man-in-the-Middle to exploit too tin sack endure exploited against both the server too the client. The number allows an assaulter to extract upward to 64kb of retentiveness from the vulnerable system, which tin sack atomic number 82 to the theft of credentials, session tokens too server someone keys.
References
http://heartbleed.com/
Cipher Suites
RC2RC2 ciphers are considered to offering solely a depression amount of safety every bit their primal length. Low strength ciphers are considered to endure those amongst a primal length <= 64-bits.
EXP-RC2-CBC-MD5
RC4
RC4 ciphers are known to endure vulnerable to a number of issues such every bit the “Invariance Weakness” start described inwards 2001. Several attacks cause got been discussed, such every bit the “Bar Mitzvah attack” demonstrated at Blackhat Asia 2015. This algorithm is too referred to every bit ARC4 or ARCFOUR (for Alleged RC4) inwards some contexts due to the term RC4 beingness trademarked. The most notable assail is probable the RC4 NOMORE assail which tin sack recover a TLS protected HTTP cookie inwards every bit footling every bit 52 hours.
ECDHE-RSA-RC4-SHA, ECDHE-ECDSA-RC4-SHA, AECDH-RC4-SHA, ADH-RC4-MD5, ECDH-RSA-RC4-SHA, ECDH-ECDSA-RC4-SHA, PSK-RC4-SHA, KRB5-RC4-SHA, KRB5-RC4-MD5, ECDHE-RSA-RC4-SHA, ECDHE-ECDSA-RC4-SHA, AECDH-RC4-SHA, ADH-RC4-MD5, ECDH-RSA-RC4-SHA, ECDH-ECDSA-RC4-SHA, PSK-RC4-SHA, KRB5-RC4-SHA, KRB5-RC4-MD5, ECDHE-RSA-RC4-SHA, ECDHE-ECDSA-RC4-SHA, AECDH-RC4-SHA, ADH-RC4-MD5, ECDH-RSA-RC4-SHA, ECDH-ECDSA-RC4-SHA, PSK-RC4-SHA, KRB5-RC4-SHA, KRB5-RC4-MD5, ECDHE-RSA-RC4-SHA, ECDHE-ECDSA-RC4-SHA, AECDH-RC4-SHA, ADH-RC4-MD5, ECDH-RSA-RC4-SHA, ECDH-ECDSA-RC4-SHA, PSK-RC4-SHA, KRB5-RC4-SHA, KRB5-RC4-MD5, EXP-RC4-MD5, RC4-64-MD5, RC4-MD5, RC4-SHA
DES
DES is a 64-bit block cipher too is hence affected yesteryear the “SWEET32” vulnerability described inwards CVE-2016-2183.
Additionally it is marked every bit a “Medium” strength cipher which is below the recommended level. Medium strength ciphers are those amongst a primal length at to the lowest degree 56 bits too less than 112 bits.
ECDHE-RSA-DES-CBC3-SHA, ECDHE-ECDSA-DES-CBC3-SHA, EDH-RSA-DES-CBC3-SHA, EDH-DSS-DES-CBC3-SHA, DH-RSA-DES-CBC3-SHA, DH-DSS-DES-CBC3-SHA, AECDH-DES-CBC3-SHA, ADH-DES-CBC3-SHA, ECDH-RSA-DES-CBC3-SHA, ECDH-ECDSA-DES-CBC3-SHA, KRB5-DES-CBC3-SHA, KRB5-DES-CBC3-MD5, ECDHE-RSA-DES-CBC3-SHA, ECDHE-ECDSA-DES-CBC3-SHA, EDH-RSA-DES-CBC3-SHA, EDH-DSS-DES-CBC3-SHA, DH-RSA-DES-CBC3-SHA, DH-DSS-DES-CBC3-SHA, AECDH-DES-CBC3-SHA, ADH-DES-CBC3-SHA, ECDH-RSA-DES-CBC3-SHA, ECDH-ECDSA-DES-CBC3-SHA, KRB5-DES-CBC3-SHA, KRB5-DES-CBC3-MD5, ECDHE-RSA-DES-CBC3-SHA, ECDHE-ECDSA-DES-CBC3-SHA, EDH-RSA-DES-CBC3-SHA, EDH-DSS-DES-CBC3-SHA, DH-RSA-DES-CBC3-SHA, DH-DSS-DES-CBC3-SHA, AECDH-DES-CBC3-SHA, ADH-DES-CBC3-SHA, ECDH-RSA-DES-CBC3-SHA, ECDH-ECDSA-DES-CBC3-SHA, KRB5-DES-CBC3-SHA, KRB5-DES-CBC3-MD5, ECDHE-RSA-DES-CBC3-SHA, ECDHE-ECDSA-DES-CBC3-SHA, EDH-RSA-DES-CBC3-SHA, EDH-DSS-DES-CBC3-SHA, DH-RSA-DES-CBC3-SHA, DH-DSS-DES-CBC3-SHA, AECDH-DES-CBC3-SHA, ADH-DES-CBC3-SHA, ECDH-RSA-DES-CBC3-SHA, ECDH-ECDSA-DES-CBC3-SHA, KRB5-DES-CBC3-SHA, KRB5-DES-CBC3-MD5
3DES
3DES uses a 64-bit block cipher too is hence affected yesteryear the “SWEET32” vulnerability described inwards CVE-2016-2183.
PSK-3DES-EDE-CBC-SHA, PSK-3DES-EDE-CBC-SHA, PSK-3DES-EDE-CBC-SHA, PSK-3DES-EDE-CBC-SHA
NULL
The NULL cipher suites exactly inform the browser non to encrypt data, hence effectively nullifying whatever protection given through the usage of SSL/TLS.
ECDHE-RSA-NULL-SHA, ECDHE-ECDSA-NULL-SHA, AECDH-NULL-SHA, ECDH-RSA-NULL-SHA, ECDH-ECDSA-NULL-SHA, NULL-SHA256, NULL-SHA, NULL-MD5, ECDHE-RSA-NULL-SHA, ECDHE-ECDSA-NULL-SHA, AECDH-NULL-SHA, ECDH-RSA-NULL-SHA, ECDH-ECDSA-NULL-SHA, NULL-SHA256, NULL-SHA, NULL-MD5, ECDHE-RSA-NULL-SHA, ECDHE-ECDSA-NULL-SHA, AECDH-NULL-SHA, ECDH-RSA-NULL-SHA, ECDH-ECDSA-NULL-SHA, NULL-SHA256, NULL-SHA, NULL-MD5, ECDHE-RSA-NULL-SHA, ECDHE-ECDSA-NULL-SHA, AECDH-NULL-SHA, ECDH-RSA-NULL-SHA, ECDH-ECDSA-NULL-SHA, NULL-SHA256, NULL-SHA, NULL-MD5, RSA-NULL-SHA256
Hashing
SHA-1Both Microsoft too Google cause got announced that it is inappropriate to use. Microsoft, when speaking nearly SSL/TLS for HTTPS noted dorsum inwards 2013 that they volition no longer endure supporting SHA1 every bit a safety algorithm yesteryear 2016. Google had a similar proclamation stating they volition endure penalising companies for using SHA1 during 2016 too no longer supporting it post-2016 – that announcement and a footling farther information is available here: https://security.googleblog.com/2014/09/gradually-sunsetting-sha-1.html. Microsoft too published the next article which shows displace towards deprecation inwards Internet Explorer too Edge: https://blogs.windows.com/msedgedev/2016/11/18/countdown-to-sha-1-deprecation/#Jeb54DCIEtIIcY4r.97
References
https://blogs.windows.com/msedgedev/2016/11/18/countdown-to-sha-1-deprecation/#Jeb54DCIEtIIcY4r.97
https://security.googleblog.com/2014/09/gradually-sunsetting-sha-1.html
Certificate Issues
Self-Signed Certificates are those which cause got non been signed yesteryear a recognized certificate authority. These effectively nullify the protections offered yesteryear SSL/TLS every bit an assaulter tin sack exactly exercise their ain “forged” certificate too the halt user would cause got no means of knowing that the certificate was no the 1 that should endure expected – hence allowing a positioned assaulter to found a man-in-the-middle assail to capture all encrypted information too to modify both customer requests too server responses. This is unlike to a certificate which is signed yesteryear an unrecognized Certificate Authority (CA) every bit the assaulter would non endure able to forge these certificates specifically although the customer may cause got the Certificate Authority every bit trusted inside their local store; this province of affairs is oftentimes found on internal corporate networks where the companionship cause got implemented their ain CA.Certificate amongst Wrong Hostname
If the Common Name does non fit the hostname of the server too so a user may non endure able to decide if the certificate is for that service or not, this mostly results inwards a safety mistake inside spider web browsers too requires the user to “click through” the message to stance the application. This would too forestall a user from visiting the application if HSTS is enabled. This would probable require some flat of social applied scientific discipline to endure useful to an assaulter attempting to man-in-the-middle a connection, withal users may endure used to clicking through the mistake message when visiting this service too hence non let on the illegitimate certificate.
