TLS uses asymmetric and symmetric encryption. Asymmetric encryption is used for the initial communication, followed by faster symmetric key encryption.
Symmetric ciphers are stream based or block based. Stream based encrypt one message at a time. Block based take a number of bits, and encrypt them together as one. A few symmetric key encryption algorithms are:
– AES
– Blowfish
– RC4
– DES
– 3DES
A few asymmetric key encryption algorithms are:
– DH
– RSA
– Elliptic Curve
– DSS/DSA
A couple of message digest (MD) algorithms are:
– MD5
– SHA
If you want to see which algorithms an SSL server supports, use the tool ‘sslscan’ which can be installed using ‘yum install sslscan -y’. You might have to enable EPEL repository to install using yum. After installation, if you run:
'sslscan www.google.com:443'
you will see a lot of very useful output, as show below. First you will see the algorithms that sslscan supports, followed by the ones that Google accepts. The most important item section is the one below:
Preferred Server Cipher(s):
SSLv2 0 bits (NONE)
SSLv3 128 bits ECDHE-RSA-RC4-SHA
TLSv1 128 bits ECDHE-RSA-RC4-SHA
TLS11 128 bits ECDHE-RSA-AES128-SHA
TLS12 128 bits ECDHE-RSA-AES128-GCM-SHA256
This is showing that Google prefers SSLv3, TLSv1,1.1 and 1.2. The cipher suites preferred are ECDE-RSA-RC4-SHA.
EDCE is Elliptic Curve Ephemeral Diffie Hellman which supports PFS or Perfect Forward Secrecy.
Normally with RSA, a symmetric key is picked once as part of the SSL HELLO protocol. After that the key does not change. This means that if the servers private key is compromised, then an attacker can get the symmetric key.
With EDCE and PFS, the symmetric key is changed every session, so even if one key is compromised, the other key will not be impacted.
You can configure Apache to prefer cipher suites, see:
Syed Ali 