What is the meaning of the values of the Protocols field from Get-TlsCipherSuite Output?

Question

Powershell has a Get-TlsCipherSute cmdlet that returns information about which ciphers TLS can use.

The output includes a Protocols field that seems to be set to an array of numbers, for Example:

PS C:\>Get-TlsCipherSuite -Name "AES"
KeyType               : 0
Certificate           : ECDSA
MaximumExchangeLength : 65536
MinimumExchangeLength : 0
Exchange              : ECDH
HashLength            : 0
Hash                  :
CipherBlockLength     : 16
CipherLength          : 256
BaseCipherSuite       : 49196
CipherSuite           : 49196
Cipher                : AES
Name                  : TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
Protocols             : {771, 65277}

What is the meaning of the numbers that are the value of the Protocols field for each cipher suite (for example, 771 and 652677)?

Note: If you go exploring, note that the output of this command doesn't seem to behave with select, see https://windowsserver.uservoice.com/forums/301869-powershell/suggestions/16511008-get-tlsciphersuite-does-not-output-well-behaved-ob

Answer 1

They seem to be a decimal representation of the value used in the TLS Version Field. 771 = 0x0303 = TLS_1_2, and 65277 = 0xFEFD = DTLS_1_1. You can see similar constants defined in various TLS libraries:

TLS_VERSIONS = {
    # SSL
    0x0002: "SSL_2_0", # 2
    0x0300: "SSL_3_0", # 768
    # TLS:
    0x0301: "TLS_1_0", # 769
    0x0302: "TLS_1_1", # 770
    0x0303: "TLS_1_2", # 771
    0x0304: "TLS_1_3", # 772
    # DTLS
    0x0100: "PROTOCOL_DTLS_1_0_OPENSSL_PRE_0_9_8f", # 256
    0x7f10: "TLS_1_3_DRAFT_16", # 32528
    0x7f12: "TLS_1_3_DRAFT_18", # 32530
    0xfeff: "DTLS_1_0", # 65279
    0xfefd: "DTLS_1_1", # 65277
}

So they likely represent the TLS/SSL protocol versions for which that cipher is available.

Answer 2

TLS_VERSIONS = {
    # SSL
    2       0x0002: "SSL_2_0",
    768     0x0300: "SSL_3_0",
    # TLS:
    769     0x0301: "TLS_1_0",
    770     0x0302: "TLS_1_1",
    771     0x0303: "TLS_1_2",
    772     0x0304: "TLS_1_3",
    # DTLS
    256     0x0100: "PROTOCOL_DTLS_1_0_OPENSSL_PRE_0_9_8f",
    32528   0x7f10: "TLS_1_3_DRAFT_16",
    32530   0x7f12: "TLS_1_3_DRAFT_18",
    65279   0xfeff: "DTLS_1_0",
    65277   0xfefd: "DTLS_1_1",
}