This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SSL Cipher Exchange Method when connecting to smtps

Hi,

I'm using a sophos utm 9 with smtp proxy. Things are working great so far.

I checked the provided ciphers when connecting via port 465.

this was my command:
openssl s_client -cipher 'EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA256 EECDH+aRSA+RC4 EDH+aRSA EECDH RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS' -connect my.domain:465

This is the cipher, which is used.

>>>
SSL-Session:
Protocol : TLSv1
Cipher : RC4-SHA

This thread was automatically locked due to age.

Parents

0 AndiB. over 11 years ago

Hi Bob,

you're absolutely right. There is no PSK involved.

What I wanted to say is, that on other Key-Exchange Methods than EECDH and EDH the Session key is transferred (encrypted) between Client and Server.

EECDH and EDH don't transfer the complete session key, only parts of it. This makes it much harder to decrypt even if the private key of the Server is "lost". [1][2]

RC4-SHA is the best available TLSv1 cipher, but it has some weaknesses. [3]

I'm not really firm about the compatibility of smtp Servers to TLSv1.1 or even TLSv1.2. Do you think it might cause problems if I use another Certificated based on TLSv1.1 or TLSv1.2?

[1] Diffie
[2] Elliptic curve cryptography - Wikipedia, the free encyclopedia
[3] Transport Layer Security - Wikipedia, the free encyclopedia
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 AndiB. over 11 years ago

Hi Bob,

you're absolutely right. There is no PSK involved.

What I wanted to say is, that on other Key-Exchange Methods than EECDH and EDH the Session key is transferred (encrypted) between Client and Server.

EECDH and EDH don't transfer the complete session key, only parts of it. This makes it much harder to decrypt even if the private key of the Server is "lost". [1][2]

RC4-SHA is the best available TLSv1 cipher, but it has some weaknesses. [3]

I'm not really firm about the compatibility of smtp Servers to TLSv1.1 or even TLSv1.2. Do you think it might cause problems if I use another Certificated based on TLSv1.1 or TLSv1.2?

[1] Diffie
[2] Elliptic curve cryptography - Wikipedia, the free encyclopedia
[3] Transport Layer Security - Wikipedia, the free encyclopedia
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data