{"id":216,"date":"2020-03-20T22:07:04","date_gmt":"2020-03-20T21:07:04","guid":{"rendered":"https:\/\/blog.remyblom.nl\/?p=216"},"modified":"2020-11-17T10:20:57","modified_gmt":"2020-11-17T09:20:57","slug":"article-archive-patrick-nohe-cipher-suites","status":"publish","type":"post","link":"https:\/\/blog.remyblom.nl\/?p=216","title":{"rendered":"Article Archive: Patrick Nohe – Cipher Suites"},"content":{"rendered":"\n

Every once and a while you run into an article on the internet that\u2019s\n just too good to just make a bookmark (or some similar technique that \nallows you to store the URL to that previous piece of useful \ninformation). I have been on the internet long enough to know that no \nmatter how good an article might be, just wait long enough and it will \nbe gone, some day\u2026 So I decided to store these kinds of articles right \nhere, on my own website, in what I call the Article Archive<\/strong>.<\/p>\n\n\n\n

At my work, one of the things I do is install certificates on webservers, no big deal, but I tend to want to understand what I’m doing, what certificates are doing, how TLS is making the connection to my bank secure<\/strong>. And I don’t settle for “by using cryptography”. Patrick Nohe wrote this wonderfully complete breakdown of what a cipher suite actually is and what new things TLSv1.3 is bringing us. Let’s dive in!<\/p>\n\n\n\n

Original: https:\/\/www.thesslstore.com\/blog\/cipher-suites-algorithms-security-settings\/<\/a><\/p>\n\n\n\n

Cipher Suites: Ciphers, Algorithms and Negotiating Security Settings<\/h1>\n\n\n\n

SSL\/TLS Cipher suites determine the parameters of an HTTPS connection. And\nthey\u2019ve just undergone a facelift.<\/h2>\n\n\n\n

If you interact with SSL\/TLS and HTTPS encryption long\nenough, you\u2019re eventually going to come across the term \u201ccipher suite.\u201d And\nwhile that sounds like a fancy nickname for Alan Turing\u2019s hotel room, cipher\nsuites play a critical role in every HTTPS connection you make on the internet.<\/p>\n\n\n\n

So, what are encryption ciphers? And what are cipher suites?<\/p>\n\n\n\n

\"What<\/figure>\n\n\n\n

Ciphers are algorithms, more specifically they\u2019re a set of\nsteps for performing a cryptographic function \u2013 it can be encryption, decryption,\nhashing or digital signatures. Nowadays ciphers are dependent upon the advanced\nprocessing capabilities of computers. That hasn\u2019t always been the case though.\nOne of the first, well-known historical ciphers belonged to Caesar \u2013 the very\nfirst emperor of Rome and purveyor of fancy appetizer salads \u2013 who used it to\ncommunicate with his generals during military operations.<\/p>\n\n\n\n

Over the years, ciphers have become more complex, but the\nlogic behind them has stayed the same. Whether it was Caesar crossing the\nRubicon, the infamous Enigma cipher of World War II or some of the algorithms\nof today\u2014the idea has always been to encode or encipher a message in such a way\nthat only the intended party can read it. <\/p>\n\n\n\n

Today we\u2019re going to discuss SSL\/TLS Cipher Suites \u2013 groups\nof ciphers that help secure an HTTPS connection \u2013 then go over their various\nparts and finish by looking at what\u2019s changed between TLS 1.2 and TLS 1.3.<\/p>\n\n\n\n

Let\u2019s hash it out.<\/p>\n\n\n\n

Cipher Suites \u2013 Some Background<\/h2>\n\n\n\n

As we just covered, a cipher is really just an algorithm, or\na set of steps that are used to perform a specific mathematical function \u2013 be that\nencryption, hashing or digital signatures. Ciphers have always had a basis in\nmath, even Caesar\u2019s primitive shift cipher required counting forward a designated\nnumber of spaces in the alphabet to encrypt something. <\/p>\n\n\n\n

I\u2019m going to use Caesar\u2019s cipher to explain some basic\nconcepts that will be useful later when we get into modern cipher suites. The\npiece of data or information \u2013 it\u2019s all digital now, though historically there\u2019s\ntypically been some kind of ink and paper\/parchment involved. Anyway, that original\nunencrypted piece of data would be referred to as the plaintext, as it\u2019s easily\nreadable in its raw form. After the encryption process has been performed, it\nbecomes a piece of ciphertext and should ideally be unreadable to anyone\nwithout the private key.<\/p>\n\n\n\n

Keys vs. Algorithms<\/h3>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Encryption is performed by keys, but it\u2019s important to square\nhow keys and algorithms\/ciphers fit together. <\/p>\n\n\n\n

The algorithm or cipher used is just that, it\u2019s a sequence\nof steps that must be used to encrypt the plaintext. <\/p>\n\n\n\n

Depending on the cryptosytem, either the values within that\nalgorithm, or the value the algorithm arrives at itself, are the keys. <\/p>\n\n\n\n

We\u2019ll clarify that point in a minute, just think of it this\nway: the algorithms are the general principles\/rules used by a given cryptosystem,\nthe keys are what actually performs the function. <\/p>\n\n\n\n

It\u2019s just Math<\/h3>\n\n\n\n

Sometimes it\u2019s best to illustrate with an example so let\u2019s go\nback to Caesar\u2019s cipher and illustrate. In Caesar\u2019s cipher, the actual\nalgorithm is: <\/p>\n\n\n\n

\"caesar<\/figure>\n\n\n\n

Ok, now let\u2019s take a closer look at each component. <\/p>\n\n\n\n

Variable<\/strong> <\/td>Description <\/strong> <\/td><\/tr>
x<\/strong> <\/td>x represents the raw input, in this case x refers to whatever letter we\u2019re shifting <\/td><\/tr>
e(x) <\/strong> <\/td>e(x) represents the encrypted value <\/td><\/tr>
k<\/strong> <\/td>k represents the key <\/td><\/tr>
mod<\/strong> <\/td>mod represents the modulus <\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

In Caesar\u2019s cipher, the key is simply the number of spaces\nyou decide to shift the letters. So, in the example below the key would be 3.\nWe\u2019re shifting everything three spaces forward. <\/p>\n\n\n\n

\"Caesar<\/figure>\n\n\n\n

Now let\u2019s add in the modulus. Modular arithmetic wraps\naround after it reaches the modulus, which is basically the end of the line,\nthe number cap \u2013 however you want to think about it. With the alphabet, the\nmodulus is obviously 26. There are 26 letters, so if you want to move a \u201cY\u201d\nthree spaces forward you have to wrap around and start back at 1 (or A) again.\nSo in this instance, the equation would be B = (Y + 3)(mod 26).<\/p>\n\n\n\n

\"Reacharound<\/figure>\n\n\n\n

Modern Ciphers & Cipher Suites<\/h2>\n\n\n\n

It\u2019s no different at the digital level. The math is far more\ncomplicated now \u2013 no human could do it efficiently \u2013 but the concept is still\nthe same. It\u2019s all just math. Now let\u2019s apply what we learned about algorithms\nin general to SSL\/TLS and HTTPS connections. <\/p>\n\n\n\n

\"Modern<\/figure>\n\n\n\n

An HTTPS connection is actually a fairly complicated\nprocess. Last week we took a deep dive on the TLS handshake. This is the process\nwhere a client and server agree on a mutually support cipher suite and then use\nthe chosen cipher suite to negotiate a secure connection. <\/p>\n\n\n\n

Part of what makes the handshake so complicated is that it\nleverages several different cryptographic functions to achieve the HTTPS connection.\nDuring the handshake, the client and server will use:<\/p>\n\n\n\n