-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
39 changed files
with
447 additions
and
161 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +0,0 @@ | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,54 @@ | ||
| --- | ||
| title: Recommended cipher suites | ||
| description: Reduce the attack surface of your website by enabling secure handshakes | ||
| layout: learn-single | ||
| --- | ||
|
|
||
| ## Overview | ||
|
|
||
| In {{% year %}}, there are only two configurations which are considered fully secure, and both should be offered to end-users: | ||
|
|
||
| ## TLS versions | ||
|
|
||
| * <span class="ui-badge-success-wrap">{{% svg-check %}} TLS 1.3</span>+ <span class="ui-badge-success-wrap">{{% svg-check %}} TLS 1.2</span> | ||
|
|
||
| * <span class="ui-badge-error-wrap">{{% svg-x %}} TLS 1.1</span>, <span class="ui-badge-error-wrap">{{% svg-x %}} TLS 1.0</span>, <span class="ui-badge-error-wrap">{{% svg-x %}} SSLv3</span>, and <span class="ui-badge-error-wrap">{{% svg-x %}} SSLv2</span> | ||
|
|
||
| ## TLS 1.3 cipher suites | ||
|
|
||
| In order to simplify configuration and increase security, [TLS 1.3] _only defines_ three cipher suites which are meant to be non-configurable. | ||
|
|
||
| 1. <span class="ui-badge-success-wrap">{{% svg-check %}} TLS_AES_128_GCM_SHA256</span> | ||
|
|
||
| 1. <span class="ui-badge-success-wrap">{{% svg-check %}} TLS_AES_256_GCM_SHA384</span> | ||
|
|
||
| 1. <span class="ui-badge-success-wrap">{{% svg-check %}} TLS_CHACHA20_POLY1305_SHA256</span> | ||
|
|
||
| ## TLS 1.2 cipher suites with _Forward Secrecy_ | ||
|
|
||
| ### Recommended | ||
|
|
||
| [TLS 1.2] carried-forward the habit of allowing administrators to configure which cipher suites to support, which led to _several_ security vulnerabilies being exposed during the 2010s. | ||
|
|
||
| As a result, these are the only cipher suites with no known vulnerabilities left, and are likely to work with most server software. | ||
|
|
||
| 1. <span class="ui-badge-success-wrap">{{% svg-check %}} TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256</span> | ||
|
|
||
| 1. <span class="ui-badge-success-wrap">{{% svg-check %}} TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384</span> | ||
|
|
||
| 1. <span class="ui-badge-success-wrap">{{% svg-check %}} TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256</span> | ||
|
|
||
| These are equivalent to the cipher suite identifiers used in **TLS 1.3**. The only difference being that they specify the key exchange (`ECDHE`) and the authenticating signing mechanism (`ECDSA`), whereas the TLS 1.3 cipher suites do not. | ||
|
|
||
| ### Tolerable | ||
|
|
||
| The following cipher suites are **also secure**, and you can add them **in addition to** the _Recommended_ cipher suites. However they aren't **recommended** because _RSA Authentication Signing_ with keys over 2048 bits can have a notable impact to performance. | ||
|
|
||
| 1. <span class="ui-badge-success-wrap">{{% svg-check %}} TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256</span> | ||
|
|
||
| 1. <span class="ui-badge-success-wrap">{{% svg-check %}} TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384</span> | ||
|
|
||
| 1. <span class="ui-badge-success-wrap">{{% svg-check %}} TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256</span> | ||
|
|
||
| [TLS 1.2]: https://datatracker.ietf.org/doc/html/rfc5246 | ||
| [TLS 1.3]: https://datatracker.ietf.org/doc/html/rfc8446 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,53 @@ | ||
| --- | ||
| title: Camellia | ||
| description: ✅ Secure encryption algorithm | ||
| layout: learn-single | ||
|
|
||
| tls_part: encryption-algo | ||
|
|
||
| learn_more: | ||
| - text: 'Official English-Language Camellia Homepage' | ||
| url: https://info.isl.ntt.co.jp/crypt/eng/camellia/ | ||
| source: NTT | ||
|
|
||
| - text: 'A Description of the Camellia Encryption Algorithm' | ||
| url: https://datatracker.ietf.org/doc/html/rfc3713 | ||
| source: IETF | ||
|
|
||
| - text: 'Addition of the Camellia Cipher Suites to Transport Layer Security (TLS)' | ||
| url: https://datatracker.ietf.org/doc/html/rfc6367 | ||
| source: IETF | ||
|
|
||
| - text: 'Camellia source code' | ||
| url: https://embeddedsw.net/Cipher_Reference_Home.html#CAMELLIA | ||
|
|
||
| --- | ||
|
|
||
| ## Summary | ||
|
|
||
| [Camellia] is a symmetric key block cipher developed by _Mitsubishi Electric_ and _NTT of Japan_, approved for use by [ISO/IEC][ISO 18033-3], [NESSIE], and [CRYPTREC]. | ||
|
|
||
| It is considered a modern, safe cipher with security levels comparable to [AES]({{% relref "AES" %}}). Camellia has been adopted in various security libraries, protocols, and applications, including TLS, IPsec, Kerberos, and OpenPGP. | ||
|
|
||
| It became an international standard in [ISO 18033-3]. | ||
|
|
||
| ## Information | ||
|
|
||
| | Field | Value | | ||
| |--------------|---------------------------------------------------------------| | ||
| | Kind | {{% param-kind %}} | | ||
| | Invented | 2000 | | ||
| | Cracked | - | | ||
| | Ephemeral | _Yes_ | | ||
| | Related tech | [IPsec], [Kerberos], [PGP], [PKCS #11], [S/MIME], [VeraCrypt] | | ||
|
|
||
| [Camellia]: https://en.wikipedia.org/wiki/Camellia_(cipher) | ||
| [CRYPTREC]: https://en.wikipedia.org/wiki/CRYPTREC | ||
| [IPsec]: https://en.wikipedia.org/wiki/IPsec | ||
| [ISO 18033-3]: https://www.iso.org/standard/54531.html | ||
| [Kerberos]: https://en.wikipedia.org/wiki/Kerberos_(protocol) | ||
| [NESSIE]: https://en.wikipedia.org/wiki/NESSIE | ||
| [PGP]: https://pgpkeys.org/docs/pgpfaq.html#HDPK | ||
| [PKCS #11]: https://docs.oasis-open.org/pkcs11/pkcs11-curr/v2.40/pkcs11-curr-v2.40.html | ||
| [S/MIME]: https://datatracker.ietf.org/doc/html/rfc8551 | ||
| [VeraCrypt]: https://en.wikipedia.org/wiki/VeraCrypt |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.