Different result of TLS 1.0 cipher suites
I've run the tool on 104.16.132.229, the IP address of cloudflare.com
Command: cryptolyze tls1 ciphers https://104.16.132.229:443
2024-01-30T08:48:12+0000 Analysis started; protocol="tls1", analyzer="ciphers"
2024-01-30T08:48:12+0000 Server offers cipher suite TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (TLS 1.0)
2024-01-30T08:48:12+0000 Server offers cipher suite TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (TLS 1.0)
* Target:
* Scheme: https
* Address: 104.16.132.229
* IP address: 104.16.132.229
* Port: 443
* Protocol Version: TLS 1.0 (deprecated)
* Cipher Suites:
1. TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (ECDHE-ECDSA-AES128-SHA)
* block cipher mode cipher block chaining (CBC) is weak, due to padding oracle attack, called POODLE
* MAC SHA-1 is deprecated, due to collision attack
2. TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (ECDHE-ECDSA-AES256-SHA)
* block cipher mode cipher block chaining (CBC) is weak, due to padding oracle attack, called POODLE
* MAC SHA-1 is deprecated, due to collision attack
* Cipher Suite Preference: yes
* Long Cipher Suite List Intolerance: no
The result doesn't contain TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_3DES_EDE_CBC_SHA.
These three cipher suites are listed by other tools mentioned in the blog, e.g. Qualys SSL Labs, SSLyze.
Additionally, the result shows that there's no cipher_suite_preference for tls1.1 while other tools detected that there's server preferred order of cipher suite.
Edited by stanley