0

I guess this has been asked before, but what are the security implications of the below message? I've seen ciphers such as AES_128_GCM being labeled as "modern". Is this mitigated server side (load balancer, web server, etc...) or from the certificate itself? And is this considered a weaker form of security?

obsolete cipher

security_obscurity
  • 113
  • 9
  • The worst in that message is "RSA as key exchange mechanism". This means you don't get forward secrecy: anyone who gets the private key of the server certificate, even after it expires, can decrypt the entire communication. AES-CBC with HMAC-SHA1 as used in TLS1.2 is not broken in practice, it's just tricky to implement securely. Modern standards like http2 require modern crypto (PFS + AEAD), but it doesn't mean everything else is as broken as RC4. – Z.T. Oct 29 '15 at 11:46
  • And how is this mitigated or fixed, server side or from the certificate itself? – security_obscurity Oct 29 '15 at 13:12

0 Answers0