TLS Protocol
The Internet Engineering Task Force (IETF) publishes the TLS security protocol, which is used to ensure the integrity and privacy of communications over a computer network. This protocol describes how various algorithms ( "cryptographic primitives" ) are used to achieve this goal. OpenSSL is the software that implements this security protocol.
TLS means "Transport Layer Security". The old name of this protocol was "Secure Socket Layer" ( SSL ). That is why we have the name "OpenSSL".
Cipher Suites Nomenclature
"Cipher suites" are security protocol algorithms ( "cryptographic primitives" ) that are usually used together.
We can run this command to list cipher suites.openssl ciphers -v Command " ciphers" will list the cipher suites, and option "-v" will give us a verbose presentation. |  |
| The name of one cipher suite is divided into 4 parts. – The first part ( ECDHE ) is the name of the algorithm used for key exchange. – The second part ( ECDSA ) is algorithm for asymmetric cryptography. – The third part ( AES256-GCM ) is algorithm used for symmetric encryption. – The fourth part ( SHA384 ) is a hashing algorithm. | ECDHE–ECDSA–AES256-GCM–SHA384 These elements are called " Cryptographic primitives", because the are building blocks from which protocols are made. |
Only the third algorithm ( AES256-GCM ) is a cipher ( encryption ) algorithm, but traditionally we call them all together a "cipher suite".
In the second column we can see different versions of the TLS security protocol ( TLSv1.3, TLSv1.2 ). These versions are generations of this protocol from different years. Notice hat TLSv1.3 version cipher suites don't list all of the security algorithms. Key exchange algorithm and Asymmetric key algorithm are not included.
In the previous versions of the TLS standard, list of the cipher suites was huge. That was the consequence of the fact that there are many security algorithms and they can be combined in different ways. In order to simplify things, TLSv1.3 did two things:
1) It retired old security algorithms that are safe no more.
2) The name of the cipher suite is now broken into three parts ( ECDHE, ECDSA, AES256-GCM–SHA384 ). Key exchange algorithm and asymmetric key algorithm are separated. This is possible because key exchange and asymmetric key algorithms are technology that is independent from the rest of algorithms. We can choose them independently.
Cipher Command
"Cipher" command is used to list cipher suites. I will use Linux command "wc" ( word count ) to count how many cipher suites will this command return. We will test some ways how to limit number of the returned cipher suites.
openssl ciphers -v | wc | 60 | We will see 60 suites. These are the suites that OpenSSL recommend for us. |
openssl ciphers -v DEFAULT | wc | 60 | The same as above. |
openssl ciphers -v ALL | wc | 140 | This will list all of the supported suites. There are 140 suites in total. |
openssl ciphers -v HIGH | wc | 140 | This will return only strong cipher suites. All 140 cipher suites are considered strong. Options "MEDIUM" and "LOW" are no more working because such suites are deleted from TLSv1.3. |
openssl ciphers -s -v | wc | 30 | Option "-s" is for supported suites. This will return 30 suites. Some suites are not applicable on our current configuration. This could be because we disabled some suites in our configuration file, or because OpenSSL is compiled with some algorithms missing, or some other reason. |
openssl ciphers -v 'RSA SHA384' | 38 | We will filter only for these "cryptographic primitives". Only the suites that are using RSA, for asymmetric key, or SHA384, for hash, will be returned. We will get 38 suites. |
openssl ciphers -v 'RSA DEFAULT' | wc | 22 | We can combine different conditions, for example RSA and DEFUALT. |
All Possible Cipher Suites
Long lists of cipher suites, that includes deprecated historical suites, can be found on these web pages:
| https://www.iana.org/assignments/tls-parameters/tls-parameters.txt |
| https://ciphersuite.info/search/?q=aes |
Lists of Individual Algorithms
We can get lists of individual algorithms with these commands:
openssl list -key-exchange-algorithms | List all key exchange algorithms. |
openssl list -public-key-algorithms | List all asymmetric key algorithms. |
openssl list -cipher-algorithms | List all symmetric key algorithms. |
openssl list -digest-algorithms | List all hash algorithms. |
Recommended Algorithms
Key Exchange Algorithms
| TLSv1.3 only supports DHE and ECDHE. ECDHE* is better than DHE because the keys are smaller and there is less CPU usage. | * EC – Elliptic curve. This helps algorithm to be faster. |
| * DH – Diffie-Hellman algorithm. The key is never transported over network. | |
| * E – Ephemeral. Keys are temporary. Each session uses different keys. |
ECDHE and DHE provide "perfect forward secrecy". Because the keys are short-lived, even if someone steals the keys, they will only be able to decrypt communications from one session. They will not be able to decrypt messages from previous sessions.
Asymmetric Key Algorithms
Today we use either RSA or ECDSA keys. RSA keys are supported everywhere and are much more compatible. Otherwise ECDSA keys are better.
ECDSA has smaller keys, certificates, and signatures. It uses less CPU. This makes the TLS handshake between the client and server faster. This is especially important for mobile devices, high-traffic websites, and cloud services. RSA is still more popular for most websites today, but for high-performance internet services, ECDSA has taken the lead. For new installations, ECDSA is often the first choice.
| For the same level of security, ECDSA keys are much smaller than RSA keys. Even worse, RSA keys scale poorly. If the ECDSA key is doubled, then the RSA key must be 5 times larger to achieve the same level of security. This is why RSA keys will be deprecated in the near future. | ECDSA | RSA |
| 112-bit | 2048-bit | |
| 128-bit | 3072-bit | |
| 192-bit | 7680-bit | |
| 256-bit | 15360-bit |
Symmetric Encryption Algorithms
We use either CHACHA20 or the AES algorithm. CHACHA20 is a better and faster algorithm. The AES algorithm is an older algorithm and most modern processors have hardware acceleration for this algorithm. As a result, the AES algorithm is, in real-world use, faster than CHACHA20.
This is only true for computers. Phones and other mobile devices historically did not have AES hardware support, and that is why most phones today use CHACHA20. You can use the command "lscpu | grep aes" to check if your computer CPU has dedicated AES circuits.
Most servers are set up to offer AES encryption first, and CHACHA20 encryption as an alternative. One is for computers, the other for phones.
Hash Algorithms
Today we use SHA hash algorithms.
Cipher Modes
You probably noticed that AES algorithm is somehow connected with "GCM" ( AES256-GCM ). To understand GCM we must talk about cipher modes. Symmetric encryption algorithms can be divided into "stream ciphers" and "block ciphers". "block ciphers" can be further divided into different "cipher modes".
Plaintext and Ciphertext
Plaintext is unencrypted message, like "Hello world!". Ciphertext is encrypted message, something like "lloeH lr!wod".
Stream Ciphers
For stream encryption we need symmetric key, "nonce" and plaintext. Nonce is randomly selected number for each session. Each session will use different nonce. "Nonce" means number used once.Algorithm will use nonce and symmetric key to create random stream of ones and zeros. That stream is called " Keystream". Thanks to nonce, this keystream will be different each session. |  |
Keystream will be combined with the message with XOR logic. This will create the "ciphertext". | Plaintext = 101011111001 |
Keystream = 100111000010 # XOR | |
Ciphertext = 001100111011 |
For decryption, we need nonce, symmetric key and ciphertext. Nonce is public value and will be delivered to receiver. Using the same ingredients, he will generate the same "keystream". He will then apply XOR between ciphertext and the keystream to get plaintext. | Ciphertext = 001100111011 |
Keystream = 100111000010 # XOR | |
Plaintext = 101011111001 |
Why do we Need Nonce?
| Let's say that we have 2 plaintexts and a keystream. Keystream only depends on the symmetric key. | P1 = 1100 | P2 = 1010 | K = 0111 |
| Without nonce, the keystream will be the same for both messages. We will calculate ciphertexts. | C1 = 1011 | C2 = 1101 |
| Because keystream is the same, the attacker can find out the difference between two plaintexts which is the same as the difference between ciphertexts. Here is the proof. | P1 XOR P2 = C1 XOR C2 |
| So, the difference between 2 plaintexts is: | P1 XOR P2 = C1 XOR C2 = 1011 XOR 1101 = 0110 |
Hacker now knows the difference between two messages. If the hacker guess or discover the content of message P1, he immediately knows the content of the message P2. This is why we need Nonce.
Block Ciphers
Block Ciphers are divided into different "cipher modes".
ECB Cipher Mode
ECB Cipher Mode ( Electronic Code Book ) is simple. We divide our message into blocks and we encrypt each block with symmetric key.
Plaintext "110010100111" is divided into 3 blocks. | 1100 | 1010 | 0111 |
| We use symmetric key on each block to get 3 ciphertexts. |  |  |  |
Problem with ECB is that patterns from the plaintext are preserved in the ciphertext.
CBC Cipher Mode
CBC (Cipher Block Chaining) was invented to solve the problem with ECB revealing data patterns.
| We have three plaintexts. | Initializing vector IV is randomly created artificial "plaintext". | IV = 1011 | P1 = 1000 | P2 = 1110 | P3 = 1001 |
| We will XOR each plaintext with the previous one. | P1 XOR IV = 0011 | P2 XOR P1 = 0110 | P3 XOR P2 = 0111 |
| We can now use key to encrypt messages. The patterns will be hidden. |  |  |  |
Encryption of each block depends on the previous block. That is why we can not parallelize this calculation. That makes the calculation slow.
CRT Cipher Mode
"Counter" mode is using approach similar to stream ciphers. First, we generate one keystream. We add counters to that keystream.
Keystream = "0110" | 0110001 | 0110002 | 0110003 | 0110004 |
| We encrypt these combinations "keystream+counter". | 0110001 | 0021010 | 0010301 | 1004001 |
Now we have encrypted keystreams that can be XOR-ed with the plaintext.
The random part of the keystream is saved with the first block of data, and is sent to receiver. Receiver will need that keystream for decryption. So, the keystream is not hidden, but what is important is that in each session we will use different keystream because of the counter.
Each "keystream+counter" combination can be encrypted on different CPU core, so we will achieve high parallelization.
GCM Cipher Mode
All previous cipher modes are solving the problem of encryption. We can also solve the problem of integrity. Someone can tamper with our ciphertext so the edited message will be sent, and the receiver will not be able to notice that. Galois/Counter mode is made to solve that problem. This Cipher Mode introduce so-called "Authenticated encryption". This is complex algorithm that can at the same time both encrypt the data and authenticate it. GCM is based on the CRT cipher mode.
Beside "Authenticated encryption" we also need same unencrypted data, that is needed for decryption. Such data we call "Associated data". Together "Authenticated encryption AE" and "Associated data AD", make AEAD. When we look at some of the cipher suites, we will see this AEAD label:
MAC
On the image above we can see "Mac=AEAD" for one suite, and "Mac=SHA384" for another. "Mac" means "Message Authentication Code". "Mac" refers to a way how we provide integrity of data.
 | When we talked about signatures, we said that signature is encrypted combination of the hash and identification data. For calculation of a hash, we need hash algorithm like "SHA384". This was the old way of providing integrity. Before, encryption and hashing were separate activities.Today we use methods that provide Encryption and Authentication in one algorithm. That is what AEAD algorithms are about. Modern cipher suites use something like " AES256-GCM" or "CHACHA20-POLY1305" because these are modern AEAD algorithms. " HMAC" is hashed based "Mac". This refers to those old algorithms. In modern cipher suites we don't use "HMAC". We use newer technologies which are labeled as AEAD. AEAD is faster and more secure than "HMAC". |
When we look at the first cipher suite from the image above "DHE-RSA-AES128-GCM-SHA256", we can see that "Mac=AEAD". In this case SHA256 refers to hash algorithm used for something else ( for example, for initializing vector, or for keystream ), and is not used for providing the integrity of messages.
Stream vs Block Ciphers
There is not much difference between stream and block ciphers. POLY1305 is a stream cipher. It is used together with CHACHA20 encryption and that is why is popular on phones. GCM is used on computers with AES, because computer CPUs have hardware support for AES. Both ciphers are secure and AEAD, and we can use any of them.