If you are exploring and testing SSL, the SSL Labs tools come in handy. For instance, see what Gmail and Github are doing:
https://www.ssllabs.com/ssldb/analyze.html?d=mail.google.com
Nginx doesn't suck at SSL after all
101–110 of 112 posts
Re: Nginx doesn't suck at SSL after all
#102Thanks to Matt and everyone who contributed to figuring this out - and then figuring it out again. Comments on the nginx mailing list (which I encourage you to subscribe to if you're a user):
Re: Nginx doesn't suck at SSL after all
#103Earlier quoted context omitted.
Presumably Amazon, Facebook and Google are using RC4 for speed reasons, though it's not really thought to be secure anymore.
RC4 is fine in SSL/TLS. Nobody likes it, but until relatively recently, the AES ciphersuites were all CBC mode, which means they burned a couple bytes of padding for every record. RC4 is also faster than AES, which was, until very recently, an issue for server performance. We have AES-CTR ciphersuites now, but I'm not sure how widely deployed they are.
The padding for AES cipher suites isn't a significant performance issue. The per-record IV in TLS 1.1 and later, the overhead of the tls-cbc.txt workaround for earlier versions, and/or the extra block(s) of encryption required for HMAC-SHA-2-based cipher suites are bigger performance issues.
RC4 is faster than AES on older processors. On the current generation of Intel server processors, AES is faster because of AES-NI.
AES-GCM cipher suites should be even faster yet on those processors, but they are not widely implemented. Also, I wouldn't be surprised to see more interesting papers being published about weaknesses in the GMAC function in the near future. (Note: I don't have any knowledge of upcoming papers; I am guessing there will be some based on the recent paper regarding the discovery of unexpected weak keys in GMAC.) Nonetheless, I suspect that NSS will implement them because they are part of the NSA Suite B profile for TLS and some NSS developers want a complete implementation of that.
Re: Nginx doesn't suck at SSL after all
#104Earlier quoted context omitted.
Presumably Amazon, Facebook and Google are using RC4 for speed reasons, though it's not really thought to be secure anymore.
RC4 is fine in SSL/TLS. Nobody likes it, but until relatively recently, the AES ciphersuites were all CBC mode, which means they burned a couple bytes of padding for every record. RC4 is also faster than AES, which was, until very recently, an issue for server performance. We have AES-CTR ciphersuites now, but I'm not sure how widely deployed they are.
I was under the impression that RC4-MD5 was no longer recommended but RC4-SHA was okay (comparatively). Is this incorrect?
Re: Nginx doesn't suck at SSL after all
#105Earlier quoted context omitted.
Presumably Amazon, Facebook and Google are using RC4 for speed reasons, though it's not really thought to be secure anymore.
While I would certainly prefer to see the major players leading the way in adoption of AES by default, RC4-MD5 persists for at least 2 reasons: 1) Habit 2) As implemented/deployed in SSL, it still provides some security RC4 has gotten a bad reputation in large part because of its poor application in WEP that resulted in keys being rapidly recovered by sniffing traffic. The Wikipedia entry is a good place to start htt…
I just did a quick dig to see if browsers now allow the user to specify a preferred cipher but it looks like things have not progressed. Chrome for instance has marked a request as WONTFIX.
Re: Nginx doesn't suck at SSL after all
#106Earlier quoted context omitted.
That's the trick -- you can enable your DHE cipher all day long, but if the code doesn't set up DHparams, it will never work. Here's a quick (no error checking) way to set up DHparams if they are appended to a cert: BIO *bio = BIO_new_file(path_to_a_file_with_dhparams, "r"); DH *dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL); BIO_free(bio); SSL_CTX_set_tmp_dh(ctx, dh); DH_free(dh); Where do the DH parameters come…
Doh! 'seiji wins. I was way too glib about DHE. Sorry.
Just a bit of history: I was the one that prodded Igor to add this.
I had been checking things out in nginx and noticed that DH was not implemented. One quick email to Igor and he got it done the same day along with getting this into the next version of nginx. Dude is bad ass.
Now if only someone can convince him or provide a patch to add SPDY support to nginx...
Re: Nginx doesn't suck at SSL after all
#107Earlier quoted context omitted.
"Patchy security"? What are you on about?
I'm refering to the portion of the comment I was responding to: "These "financial secrets" are emailed in the clear after every transaction" The implication being that since they were sending the information in the clear in a separate part of their system, that they were wrong in configuring their https site as they did. I object to that conclusion.
No, that indicates that these were not actually financian secrets, hence the quotes.
Re: Nginx doesn't suck at SSL after all
#108In case you're wondering what "Perfect Forward Secrecy" is: SSL/TLS, like most protocols, uses (expensive, dangerous) RSA to exchange (cheap, simple) AES or RC4 session keys; bulk data is encrypted with session key. In the normal protocol, if you lose the RSA key, an attacker can retroactively decrypt the session keys, which are protected only by that same RSA key. In ephemeral DH mode, instead of encrypting a sessio…
It could be a really nice blog post. A lot of people get lost on wikipedia pages like that.
Re: Nginx doesn't suck at SSL after all
#109Earlier quoted context omitted.
I'm refering to the portion of the comment I was responding to: "These "financial secrets" are emailed in the clear after every transaction" The implication being that since they were sending the information in the clear in a separate part of their system, that they were wrong in configuring their https site as they did. I object to that conclusion.
No, that indicates that these were not actually financian secrets, hence the quotes.
I'm going to go ahead and give the developers of the particular site the benefit of the doubt and not you, if you don't mind.
Furthermore, one particular site using https in a particular mode when they don't need to use https at all is still not a logical argument against other sites using https with those ciphers.
Re: Nginx doesn't suck at SSL after all
#110Earlier quoted context omitted.
RC4 is fine in SSL/TLS. Nobody likes it, but until relatively recently, the AES ciphersuites were all CBC mode, which means they burned a couple bytes of padding for every record. RC4 is also faster than AES, which was, until very recently, an issue for server performance. We have AES-CTR ciphersuites now, but I'm not sure how widely deployed they are.
I was under the impression that RC4-MD5 was no longer recommended but RC4-SHA was okay (comparatively). Is this incorrect?
The hash algorithm in TLS is HMAC-hash. Some uses of MD5 like secret suffix are now insecure (which is why usage of MD5 for certificate signing ended long ago), but HMAC is not one of them.