how2itsec: Which SSL/TLS settings, Algorithms and Methods to use

Recommended Server Encryption Methods

Hash-Algorithms: SHA3, SHA2-512, SHA2-384, SHA2-256, Poly1305

Symmetric Encryption Algorithms: AES-GCM-256, AES-GCM-128, ChaCha20

Key-Exchange-Methods: ECDHE, DHE-4096Bit, Diffie-Hellman group 24 (Modular exponentiation group with a 2048-bit modulus and 256-bit prime order subgroup), 521 bit elliptic curve (DH-Group 21), 384 bit elliptic curve (DH-Group 19), 256 bit elliptic curve (DH-Group 19), DHE-2048Bit (DH-Group 14)

Certificate-Keys: EC 256Bit, RSA-4096Bit, RSA-2048Bit,

Certificate Signing: ECDSA, RSA

Encryption-Protocols: TLS 1.3, TLS 1.2

Webserver Downgrade attack prevention: TLS_FALLBACK_SCSV, Strict Transport Security (HSTS)

Password Hashing Algorithms: Argon2, scrypt, bcrypt, PBKDF2

Source: F5

List of Recommended TLS-Ciphers:

Very secure:

Secure:

TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca9)
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca8)
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (0xc02c)
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b)
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (0x9f)
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (0x9e)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028)
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027)
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)
TLS_RSA_WITH_AES_256_GCM_SHA384 (0x9d)
TLS_RSA_WITH_AES_128_GCM_SHA256 (0x9c)
TLS_RSA_WITH_AES_256_CBC_SHA256 (0x3d)

how2itsec

Which SSL/TLS settings, Algorithms and Methods to use

Recommended Server Encryption Methods

List of Recommended TLS-Ciphers:

Very secure:

Secure:

High Compatibility but still secure:

No comments:

Post a Comment

Splunk UseCase for attacks against FortiGate Firewall management interfaces

Impressum