Appendix C. Unsafe TLS Cipher Suites
TLS implementations are often found to support weak cipher suites. Adversaries with network access can exploit vulnerabilities within these to decrypt ciphertext via man-in-the-middle in particular. The suites listed in Tables C-1 through C-3 lack authentication (anonymous ciphers), perform symmetric encryption using no key (null ciphers), and operate in an exploitable manner (export-grade ciphers). As such, they should be avoided and not exist within modern environments.
Code | Name | Code | Name |
---|---|---|---|
0x0017 | TLS_DH_Anon_EXPORT_WITH_RC4_40_MD5 | 0x0089 | TLS_DH_Anon_WITH_CAMELLIA_256_CBC_SHA |
0x0018 | TLS_DH_Anon_WITH_RC4_128_MD5 | 0x009B | TLS_DH_Anon_WITH_SEED_CBC_SHA |
0x0019 | TLS_DH_Anon_EXPORT_WITH_DES40_CBC_SHA | 0x00A6 | TLS_DH_Anon_WITH_AES_128_GCM_SHA256 |
0x001A | TLS_DH_Anon_WITH_DES_CBC_SHA | 0x00A7 | TLS_DH_Anon_WITH_AES_256_GCM_SHA384 |
0x001B | TLS_DH_Anon_WITH_3DES_EDE_CBC_SHA | 0xC015 | TLS_ECDH_Anon_WITH_NULL_SHA |
0x0034 | TLS_DH_Anon_WITH_AES_128_CBC_SHA | 0xC016 | TLS_ECDH_Anon_WITH_RC4_128_SHA |
0x003A | TLS_DH_Anon_WITH_AES_256_CBC_SHA | 0xC017 | TLS_ECDH_Anon_WITH_3DES_EDE_CBC_SHA |
0x0046 | TLS_DH_Anon_WITH_CAMELLIA_128_CBC_SHA | 0xC018 | TLS_ECDH_Anon_WITH_AES_128_CBC_SHA |
0x006C | TLS_DH_Anon_WITH_AES_128_CBC_SHA256 | 0xC019 | TLS_ECDH_Anon_WITH_AES_256_CBC_SHA |
0x006D | TLS_DH_Anon_WITH_AES_256_CBC_SHA256 |
Code | Name | Code | Name |
---|---|---|---|
0x0000 | TLS_NULL_WITH_NULL_NULL | 0x00B4 | TLS_DHE_PSK_WITH_NULL_SHA256 ... |
Get Network Security Assessment, 3rd Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.