Capítulo 4 de 8

Cipher suites and the record layer

What AEAD means, how records are protected, and how to choose a modern suite list.

Unos 11 minutos de lectura

Al terminar este capítulo podrá

  • Read a TLS 1.3 cipher suite name
  • Explain the difference between AEAD and CBC-with-MAC
  • Describe what the record layer does with application data
  • Write a defensible minimum TLS configuration

En este capítulo

  1. 1. A suite is a bundle
  2. 2. AEAD versus older constructions
  3. 3. The record layer
  4. 4. A defensible configuration

01A suite is a bundle

A cipher suite names the algorithms used together. In TLS 1.2 the name was long because it listed key exchange, authentication, encryption and hashing. In TLS 1.3 the key exchange is negotiated separately, so the name is short.

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
  key exchange ECDHE | auth RSA | cipher AES-128-GCM | hash SHA256

TLS_AES_256_GCM_SHA384
  cipher AES-256-GCM | hash SHA384   (TLS 1.3; key exchange negotiated elsewhere)
Reading two suite names

02AEAD versus older constructions

Authenticated encryption with associated data (AEAD) combines encryption and integrity in one operation with one key. AES-GCM and ChaCha20-Poly1305 are the two you will meet. Older constructions stitched together a cipher and a separate MAC, which produced a long history of padding-oracle bugs in CBC mode.

ConstructionStatusWhy
AES-GCMRecommendedAEAD, hardware accelerated on most CPUs
ChaCha20-Poly1305RecommendedAEAD, fast without AES hardware, constant time
AES-CBC + HMACLegacyPadding oracles, ordering mistakes, slower
RC4ProhibitedBroken keystream, biases exploitable in practice
NULL / anonymousProhibitedNo confidentiality or no authentication

03The record layer

Application data is split into records. Each record is encrypted with the session key and a nonce derived from an implicit sequence number, so records cannot be reordered, dropped or duplicated without detection.

  • Sequence numbers are implicit and increase per record; reusing a nonce would be fatal, so they are never reused within a connection
  • Keys are re-established on new connections, which is one reason long-lived connections are not unlimited
  • Record size limits exist to bound memory and to limit the value of guessing attacks

04A defensible configuration

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';
ssl_prefer_server_ciphers off;
ssl_session_tickets off;
ssl_stapling on;
ssl_stapling_verify on;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
Modern baseline for a public web server

Two details students often miss: prefer_server_ciphers off lets the client choose, which is usually better on modern hardware; and Stapling depends on a valid chain being configured, or it silently stops working.

Para recordar

  • A cipher suite names the algorithms used together; TLS 1.3 suites are short
  • AEAD combines encryption and integrity, avoiding the padding-oracle era
  • The record layer protects each chunk with a key and a never-reused nonce
  • A modern baseline is TLS 1.2 plus 1.3, ECDHE suites, AEAD ciphers, stapling enabled
AnteriorKey exchange and forward secrecySiguienteCertificates at the edge

Profundice:ACME end-user guidePKI Trust Manager admin guide