[go: up one dir, main page]

Skip to content

Different result of TLS 1.0 cipher suites

I've run the tool on 104.16.132.229, the IP address of cloudflare.com

Command: cryptolyze tls1 ciphers https://104.16.132.229:443

2024-01-30T08:48:12+0000 Analysis started; protocol="tls1", analyzer="ciphers"
2024-01-30T08:48:12+0000 Server offers cipher suite TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (TLS 1.0)
2024-01-30T08:48:12+0000 Server offers cipher suite TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (TLS 1.0)
* Target:
    * Scheme: https
    * Address: 104.16.132.229
    * IP address: 104.16.132.229
    * Port: 443
    * Protocol Version: TLS 1.0 (deprecated)
* Cipher Suites:
    1. TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (ECDHE-ECDSA-AES128-SHA)
        * block cipher mode cipher block chaining (CBC) is weak, due to padding oracle attack, called POODLE
        * MAC SHA-1 is deprecated, due to collision attack
    2. TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (ECDHE-ECDSA-AES256-SHA)
        * block cipher mode cipher block chaining (CBC) is weak, due to padding oracle attack, called POODLE
        * MAC SHA-1 is deprecated, due to collision attack
* Cipher Suite Preference: yes
* Long Cipher Suite List Intolerance: no

The result doesn't contain TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_3DES_EDE_CBC_SHA.
These three cipher suites are listed by other tools mentioned in the blog, e.g. Qualys SSL Labs, SSLyze.
Additionally, the result shows that there's no cipher_suite_preference for tls1.1 while other tools detected that there's server preferred order of cipher suite.

Edited by stanley