E
Size: a a a
2019 October 29
SP
Комрады, подскажите, при TLS-соединении (handshake) на стороне сервера где происходит подтверждение алгоритма шифрования? Возможные варианты - openssl и nginx.
SP
Спасибо! Но там концептуальное описание. Меня интересовала именно реализация концепции.
VB
Cipher Suite
The server has selected cipher suite 0xC013 (TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) from the list of options given by the client.
The server has selected cipher suite 0xC013 (TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) from the list of options given by the client.
VB
Cipher Suites
The client provides an ordered list of which cryptographic methods it will support for key exchange, encryption with that exchanged key, and message authentication. The list is in the order preferred by the client, with highest preference first.
00 20 - 0x20 (32) bytes of cipher suite data
cc a8 - assigned value for TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
cc a9 - assigned value for TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
c0 2f - assigned value for TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
c0 30 - assigned value for TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
c0 2b - assigned value for TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
c0 2c - assigned value for TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
c0 13 - assigned value for TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
c0 09 - assigned value for TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
c0 14 - assigned value for TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
<портянка вариантов>
Т.е. выплёвывает список клиент, а сервер потом из них выбирает. https://medium.com/@mvuksano/how-to-properly-configure-your-nginx-for-tls-564651438fe0
The client provides an ordered list of which cryptographic methods it will support for key exchange, encryption with that exchanged key, and message authentication. The list is in the order preferred by the client, with highest preference first.
00 20 - 0x20 (32) bytes of cipher suite data
cc a8 - assigned value for TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
cc a9 - assigned value for TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
c0 2f - assigned value for TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
c0 30 - assigned value for TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
c0 2b - assigned value for TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
c0 2c - assigned value for TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
c0 13 - assigned value for TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
c0 09 - assigned value for TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
c0 14 - assigned value for TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
<портянка вариантов>
Т.е. выплёвывает список клиент, а сервер потом из них выбирает. https://medium.com/@mvuksano/how-to-properly-configure-your-nginx-for-tls-564651438fe0
N
Cipher Suites
The client provides an ordered list of which cryptographic methods it will support for key exchange, encryption with that exchanged key, and message authentication. The list is in the order preferred by the client, with highest preference first.
00 20 - 0x20 (32) bytes of cipher suite data
cc a8 - assigned value for TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
cc a9 - assigned value for TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
c0 2f - assigned value for TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
c0 30 - assigned value for TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
c0 2b - assigned value for TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
c0 2c - assigned value for TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
c0 13 - assigned value for TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
c0 09 - assigned value for TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
c0 14 - assigned value for TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
<портянка вариантов>
Т.е. выплёвывает список клиент, а сервер потом из них выбирает. https://medium.com/@mvuksano/how-to-properly-configure-your-nginx-for-tls-564651438fe0
The client provides an ordered list of which cryptographic methods it will support for key exchange, encryption with that exchanged key, and message authentication. The list is in the order preferred by the client, with highest preference first.
00 20 - 0x20 (32) bytes of cipher suite data
cc a8 - assigned value for TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
cc a9 - assigned value for TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
c0 2f - assigned value for TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
c0 30 - assigned value for TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
c0 2b - assigned value for TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
c0 2c - assigned value for TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
c0 13 - assigned value for TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
c0 09 - assigned value for TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
c0 14 - assigned value for TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
<портянка вариантов>
Т.е. выплёвывает список клиент, а сервер потом из них выбирает. https://medium.com/@mvuksano/how-to-properly-configure-your-nginx-for-tls-564651438fe0
О, мне пригодится
SP
Cipher Suites
The client provides an ordered list of which cryptographic methods it will support for key exchange, encryption with that exchanged key, and message authentication. The list is in the order preferred by the client, with highest preference first.
00 20 - 0x20 (32) bytes of cipher suite data
cc a8 - assigned value for TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
cc a9 - assigned value for TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
c0 2f - assigned value for TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
c0 30 - assigned value for TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
c0 2b - assigned value for TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
c0 2c - assigned value for TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
c0 13 - assigned value for TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
c0 09 - assigned value for TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
c0 14 - assigned value for TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
<портянка вариантов>
Т.е. выплёвывает список клиент, а сервер потом из них выбирает. https://medium.com/@mvuksano/how-to-properly-configure-your-nginx-for-tls-564651438fe0
The client provides an ordered list of which cryptographic methods it will support for key exchange, encryption with that exchanged key, and message authentication. The list is in the order preferred by the client, with highest preference first.
00 20 - 0x20 (32) bytes of cipher suite data
cc a8 - assigned value for TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
cc a9 - assigned value for TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
c0 2f - assigned value for TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
c0 30 - assigned value for TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
c0 2b - assigned value for TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
c0 2c - assigned value for TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
c0 13 - assigned value for TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
c0 09 - assigned value for TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
c0 14 - assigned value for TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
<портянка вариантов>
Т.е. выплёвывает список клиент, а сервер потом из них выбирает. https://medium.com/@mvuksano/how-to-properly-configure-your-nginx-for-tls-564651438fe0
Да, в правильном направлении двигаемся