0

ServerHello of a TLS handshake returned the following ciphersuite:

Cipher Suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x0033)

But when I used openssl to list the ciphers on the server, it seemed a matching cipher suite could not be found:

$  openssl ciphers |tr ':' '\n'|grep DHE|grep RSA|grep AES|grep SHA
DHE-RSA-AES256-GCM-SHA384
DHE-RSA-AES256-SHA256
DHE-RSA-AES256-SHA
DHE-RSA-AES128-GCM-SHA256
DHE-RSA-AES128-SHA256
DHE-RSA-AES128-SHA

Compared with what I got from ServerHello, CBC mode is missing in these cipher suites. If I search by CBC, then other ciphers are not matching:

$  openssl ciphers |tr ':' '\n'|grep CBC
SRP-DSS-AES-256-CBC-SHA
SRP-RSA-AES-256-CBC-SHA
SRP-AES-256-CBC-SHA
SRP-DSS-AES-128-CBC-SHA
SRP-RSA-AES-128-CBC-SHA
SRP-AES-128-CBC-SHA
SRP-DSS-3DES-EDE-CBC-SHA
SRP-RSA-3DES-EDE-CBC-SHA
SRP-3DES-EDE-CBC-SHA
EDH-RSA-DES-CBC3-SHA
EDH-DSS-DES-CBC3-SHA
DH-RSA-DES-CBC3-SHA
DH-DSS-DES-CBC3-SHA
DES-CBC3-SHA

Could anyone explain why is that? If I want to disable

Cipher Suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x0033)

which cipher suite in the list should I pick?

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.