I'm using a Verisign Extended SSL cert which is piped downstream by nginx running the default cipher suite config.
This results in a 256 bit encrypted connection.
However, since it's a CBC method, should I be concerned about a BEAST attack?
The nginx manual offers the following suggestion to drop back to RC4 (which doesn't appear to be affected by that particular attack):
ssl_ciphers RC4:HIGH:!aNULL:!MD5; ssl_prefer_server_ciphers on;
That's fine, but it drops the encryption back to 128 bit, too.
Is it preferable to opt for 256 bit that's vulnerable to BEAST, or 128 bit that's not (but may be vulnerable to other attacks)?