Cybersecurity/Goverment/TLS and cyphers - Revision history

Mflavell: /* What about SSL? */

2026-10-22T16:27:50Z

What about SSL?

← Older revision		Revision as of 16:27, 22 October 2026
Line 104:		Line 104:
	─────── PROHIBITED ─────────── ──── DEPRECATED ──── ─── VALID/APPROVED ───		─────── PROHIBITED ─────────── ──── DEPRECATED ──── ─── VALID/APPROVED ───

	* Many people even developers talk about SSL - SSL is a fossil 🦖- They are realy talking about TLS but SSL is burned into the cluture very deep - for example "SSL Certificates" that are really "x.509 Cetfificates"		🤬 Many people even developers talk about SSL - SSL is a fossil 🦖- They are realy talking about TLS but SSL is burned into the cluture very deep - for example "SSL Certificates" that are really "x.509 Cetfificates"

Mflavell: /* What about SSL? */

2026-10-22T16:27:11Z

What about SSL?

← Older revision		Revision as of 16:27, 22 October 2026
Line 99:		Line 99:
	TLS (Transport Layer Security) is the direct replacement for SSL:		TLS (Transport Layer Security) is the direct replacement for SSL:

	[Netscape] [IETF Standard]		[Netscape] [IETF Standard]
	SSL 1.0 ──> SSL 2.0 ──> SSL 3.0 ──> TLS 1.0 ──> TLS 1.1 ──> TLS 1.2 ──> TLS 1.3		SSL 1.0 ──> SSL 2.0 ──> SSL 3.0 ──> TLS 1.0 ──> TLS 1.1 ──> TLS 1.2 ──> TLS 1.3
	(1994) (1995) (1996) (1999) (2006) (2008) (2018)		(1994) (1995) (1996) (1999) (2006) (2008) (2018)

Mflavell: /* What about SSL? */

2026-10-22T16:26:50Z

What about SSL?

← Older revision		Revision as of 16:26, 22 October 2026
Line 99:		Line 99:
	TLS (Transport Layer Security) is the direct replacement for SSL:		TLS (Transport Layer Security) is the direct replacement for SSL:

	[Netscape] [IETF Standard]		[Netscape] [IETF Standard]
	SSL 1.0 ──> SSL 2.0 ──> SSL 3.0 ──> TLS 1.0 ──> TLS 1.1 ──> TLS 1.2 ──> TLS 1.3		SSL 1.0 ──> SSL 2.0 ──> SSL 3.0 ──> TLS 1.0 ──> TLS 1.1 ──> TLS 1.2 ──> TLS 1.3
	(1994) (1995) (1996) (1999) (2006) (2008) (2018)		(1994) (1995) (1996) (1999) (2006) (2008) (2018)

Mflavell: /* What about SSL? */

2026-10-22T16:26:40Z

What about SSL?

← Older revision		Revision as of 16:26, 22 October 2026
Line 99:		Line 99:
	TLS (Transport Layer Security) is the direct replacement for SSL:		TLS (Transport Layer Security) is the direct replacement for SSL:

	. [Netscape] [IETF Standard]		[Netscape] [IETF Standard]
	SSL 1.0 ──> SSL 2.0 ──> SSL 3.0 ──> TLS 1.0 ──> TLS 1.1 ──> TLS 1.2 ──> TLS 1.3		SSL 1.0 ──> SSL 2.0 ──> SSL 3.0 ──> TLS 1.0 ──> TLS 1.1 ──> TLS 1.2 ──> TLS 1.3
	(1994) (1995) (1996) (1999) (2006) (2008) (2018)		(1994) (1995) (1996) (1999) (2006) (2008) (2018)

Mflavell: /* What about SSL? */

2026-10-22T16:26:16Z

What about SSL?

← Older revision		Revision as of 16:26, 22 October 2026
Line 99:		Line 99:
	TLS (Transport Layer Security) is the direct replacement for SSL:		TLS (Transport Layer Security) is the direct replacement for SSL:

	[Netscape] [IETF Standard]		. [Netscape] [IETF Standard]
	SSL 1.0 ──> SSL 2.0 ──> SSL 3.0 ──> TLS 1.0 ──> TLS 1.1 ──> TLS 1.2 ──> TLS 1.3		SSL 1.0 ──> SSL 2.0 ──> SSL 3.0 ──> TLS 1.0 ──> TLS 1.1 ──> TLS 1.2 ──> TLS 1.3
	(1994) (1995) (1996) (1999) (2006) (2008) (2018)		(1994) (1995) (1996) (1999) (2006) (2008) (2018)

Mflavell: /* What about SSL? */

2026-10-22T16:25:46Z

What about SSL?

← Older revision		Revision as of 16:25, 22 October 2026
Line 103:		Line 103:
	(1994) (1995) (1996) (1999) (2006) (2008) (2018)		(1994) (1995) (1996) (1999) (2006) (2008) (2018)
	─────── PROHIBITED ─────────── ──── DEPRECATED ──── ─── VALID/APPROVED ───		─────── PROHIBITED ─────────── ──── DEPRECATED ──── ─── VALID/APPROVED ───

			* Many people even developers talk about SSL - SSL is a fossil 🦖- They are realy talking about TLS but SSL is burned into the cluture very deep - for example "SSL Certificates" that are really "x.509 Cetfificates"

Mflavell: /* Why not TLS 1.1 */

2026-10-22T16:23:38Z

Why not TLS 1.1

← Older revision		Revision as of 16:23, 22 October 2026
Line 94:		Line 94:
	** An attacker could modifiy the handshake and downgrade the connection.		** An attacker could modifiy the handshake and downgrade the connection.
	** Injection of data into the TLS session.		** Injection of data into the TLS session.


	== What about SSL? ==		== What about SSL? ==

Mflavell: /* What about SSL? */

2026-10-22T16:23:15Z

What about SSL?

← Older revision		Revision as of 16:23, 22 October 2026
Line 100:		Line 100:
	TLS (Transport Layer Security) is the direct replacement for SSL:		TLS (Transport Layer Security) is the direct replacement for SSL:

	[Netscape] [IETF Standard]		[Netscape] [IETF Standard]
	SSL 1.0 ──> SSL 2.0 ──> SSL 3.0 ──> TLS 1.0 ──> TLS 1.1 ──> TLS 1.2 ──> TLS 1.3		SSL 1.0 ──> SSL 2.0 ──> SSL 3.0 ──> TLS 1.0 ──> TLS 1.1 ──> TLS 1.2 ──> TLS 1.3
	(1994) (1995) (1996) (1999) (2006) (2008) (2018)		(1994) (1995) (1996) (1999) (2006) (2008) (2018)
	─────── PROHIBITED ─────────── ──── DEPRECATED ──── ─── VALID/APPROVED ───		─────── PROHIBITED ─────────── ──── DEPRECATED ──── ─── VALID/APPROVED ───

Mflavell: Created page with " == TLS Versions == * TLS <1.2 - Should never be used * TLS 1.2 - Used under some circumstances * TLS 1.3 - Preferred == Valid Cypher Suites == The TLS version alone is not enough, the underlying hardware, software and cypher suites must be considered. {| class="wikitable sortable" ! Protocol Version ! NIST Priority ! Standard RFC Cipher Name ! Key Exchange / Encryption Details |- | '''TLS 1.3''' | style="background:#d4edda;" | 🌟 '''Preferred''' | TLS_AES_128_GC..."

2026-10-22T16:20:42Z

Created page with " == TLS Versions == * TLS <1.2 - Should never be used * TLS 1.2 - Used under some circumstances * TLS 1.3 - Preferred == Valid Cypher Suites == The TLS version alone is not enough, the underlying hardware, software and cypher suites must be considered. {| class="wikitable sortable" ! Protocol Version ! NIST Priority ! Standard RFC Cipher Name ! Key Exchange / Encryption Details |- | '''TLS 1.3''' | style="background:#d4edda;" | 🌟 '''Preferred''' | TLS_AES_128_GC..."

New page

== TLS Versions ==

* TLS <1.2 - Should never be used
* TLS 1.2 - Used under some circumstances
* TLS 1.3 - Preferred

== Valid Cypher Suites ==

The TLS version alone is not enough, the underlying hardware, software and cypher suites must be considered.

{| class="wikitable sortable"
! Protocol Version
! NIST Priority
! Standard RFC Cipher Name
! Key Exchange / Encryption Details
|-
| '''TLS 1.3'''
| style="background:#d4edda;" | 🌟 '''Preferred'''
| TLS_AES_128_GCM_SHA256
| AEAD / 128-bit AES-GCM (Mandatory baseline)
|-
| '''TLS 1.3'''
| style="background:#d4edda;" | 🌟 '''Preferred'''
| TLS_AES_256_GCM_SHA384
| AEAD / 256-bit AES-GCM (Mandatory baseline)
|-
| '''TLS 1.3'''
| style="background:#fff3cd;" | ✅ '''Acceptable'''
| TLS_AES_128_CCM_SHA256
| AEAD / 128-bit AES-CCM
|-
| '''TLS 1.2'''
| style="background:#d4edda;" | 🌟 '''Preferred'''
| TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
| ECDH Exchange + ECDSA Auth + 128-bit AES-GCM
|-
| '''TLS 1.2'''
| style="background:#d4edda;" | 🌟 '''Preferred'''
| TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
| ECDH Exchange + ECDSA Auth + 256-bit AES-GCM
|-
| '''TLS 1.2'''
| style="background:#d4edda;" | 🌟 '''Preferred'''
| TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
| ECDH Exchange + RSA Auth + 128-bit AES-GCM
|-
| '''TLS 1.2'''
| style="background:#d4edda;" | 🌟 '''Preferred'''
| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
| ECDH Exchange + RSA Auth + 256-bit AES-GCM
|-
| '''TLS 1.2'''
| style="background:#f8d7da;" | ⚠️ ''Legacy Fallback''
| TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
| ECDH Exchange + ECDSA Auth + 128-bit AES-CBC
|-
| '''TLS 1.2'''
| style="background:#f8d7da;" | ⚠️ ''Legacy Fallback''
| TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
| ECDH Exchange + ECDSA Auth + 256-bit AES-CBC
|-
| '''TLS 1.2'''
| style="background:#f8d7da;" | ⚠️ ''Legacy Fallback''
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
| ECDH Exchange + RSA Auth + 128-bit AES-CBC
|-
| '''TLS 1.2'''
| style="background:#f8d7da;" | ⚠️ ''Legacy Fallback''
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
| ECDH Exchange + RSA Auth + 256-bit AES-CBC
|-
| '''TLS 1.2'''
| style="background:#f8d7da;" | ⚠️ ''Legacy Fallback''
| TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
| Finite Field DH + RSA Auth + 128-bit AES-GCM
|-
| '''TLS 1.2'''
| style="background:#f8d7da;" | ⚠️ ''Legacy Fallback''
| TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
| Finite Field DH + RSA Auth + 256-bit AES-GCM
|}

== Why not TLS 1.1 ==

The core problem with TLS 1.1 even with a valid cypher suite is man-in-the-middle attacks.

The cypher suite only protects data after a secure connection is established. The key problem been how TLS 1.1 manages the connection.

** An attacker could modifiy the handshake and downgrade the connection.
** Injection of data into the TLS session.

== What about SSL? ==

TLS (Transport Layer Security) is the direct replacement for SSL:

[Netscape] [IETF Standard]
SSL 1.0 ──> SSL 2.0 ──> SSL 3.0 ──> TLS 1.0 ──> TLS 1.1 ──> TLS 1.2 ──> TLS 1.3
(1994) (1995) (1996) (1999) (2006) (2008) (2018)
─────── PROHIBITED ─────────── ──── DEPRECATED ──── ─── VALID/APPROVED ───