search

mozilla / server-side-tls

Server side TLS Tools
https://ssl-config.mozilla.org
Mozilla Public License 2.0
1.12k stars 142 forks source link

Add AES-CCM ciphers to all settings #279

Open rhymeswithmogul opened 3 years ago

rhymeswithmogul commented 3 years ago

The AES-CCM ciphers and ciphersuites are missing from the Mozilla Server Side TLS document and the SSL Configurator. This cipher mode was ratified by the IETF in 2012 in RFC 6655, and are included in recent versions of OpenSSL. According to Wikipedia, they may provide better performance on embedded and low-power devices, and the cipher mode is also used in WPA2 CCMP and Bluetooth Low Energy. Despite poor support by web browsers, they are considered safe, and I feel that they should be added to the list of acceptable ciphers.

TLS 1.3 offers these ciphersuites (available in OpenSSL 1.1.1, but disabled by default):

TLS 1.2 offers these ciphers:

tomato42 commented 3 years ago

CCM_8 has weak integrity guarantees so we shouldn't enable them by default, those are useful only for specific environments

adding CCM with the full 16 byte tag it probably a good idea

makhomed commented 3 years ago

Related comments from @april about TLS_AES_128_CCM_SHA256 and TLS_AES_128_CCM_8_SHA256 ciphers:

https://github.com/mozilla/ssl-config-generator/issues/124#issuecomment-770002153

It's not generally enabled by default for most systems, and there is not much reason to enable it by default. People whose clients are embedded systems with low-power ICs that lack crypto acceleration will know to enable it on both ends. This is a small enough group of people to not manually discuss it in a document for general purpose servers.

https://github.com/mozilla/ssl-config-generator/issues/124#issuecomment-770007293

We also don't list CCM because we don't want people going out of their way to enable them when they're rarely needed. It's often not easy to do so, and by listing them it makes it seem mandatory.

So, recommending to enable TLS_AES_128_CCM_SHA256 by default in the Mozilla Server Side TLS document and the SSL Configurator is not a good idea.