<div dir="ltr">Which OpenSSL version are you testing with?</div><div class="gmail_extra"><br><div class="gmail_quote">2015-11-03 8:58 GMT+01:00 Gunnar Haslinger <span dir="ltr"><<a href="mailto:gh.bettercrypto@hitco.at" target="_blank">gh.bettercrypto@hitco.at</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br>
Azet:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Nevertheless I feel the same way, AES128 should be preferred;<br>
and that exactly what we're doing with the latest version of<br>
our bettercrypto cipherstring recommendation:<br>
<a href="https://git.bettercrypto.org/ach-master.git/blob/HEAD:/src/common/cipherStringB.tex" rel="noreferrer" target="_blank">https://git.bettercrypto.org/ach-master.git/blob/HEAD:/src/common/cipherStringB.tex</a><br>
</blockquote>
<br>
<br>
The current recommendation for Apache is different to the CipherString-B.<br>
Probably thats only a mistak (as Aaron Kaplan already answered).<br>
<br>
but even when comparing these two ciphers, none of them prefers AES128 to AES256:<br>
<br>
<br>
<a href="https://git.bettercrypto.org/ach-master.git/blob/HEAD:/src/configuration/Webservers/Apache/default-ssl" rel="noreferrer" target="_blank">https://git.bettercrypto.org/ach-master.git/blob/HEAD:/src/configuration/Webservers/Apache/default-ssl</a><br>
root@Sec-NS2:~# openssl ciphers -v 'EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA'<br>
DHE-RSA-AES256-GCM-SHA384   TLSv1.2 Kx=DH       Au=RSA  Enc=AESGCM(256)   Mac=AEAD<br>
DHE-RSA-AES256-SHA256       TLSv1.2 Kx=DH       Au=RSA  Enc=AES(256)      Mac=SHA256<br>
ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AESGCM(256)   Mac=AEAD<br>
ECDHE-RSA-AES256-SHA384     TLSv1.2 Kx=ECDH     Au=RSA  Enc=AES(256)      Mac=SHA384<br>
DHE-RSA-AES128-GCM-SHA256   TLSv1.2 Kx=DH       Au=RSA  Enc=AESGCM(128)   Mac=AEAD<br>
DHE-RSA-AES128-SHA256       TLSv1.2 Kx=DH       Au=RSA  Enc=AES(128)      Mac=SHA256<br>
ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AESGCM(128)   Mac=AEAD<br>
ECDHE-RSA-AES128-SHA256     TLSv1.2 Kx=ECDH     Au=RSA  Enc=AES(128)      Mac=SHA256<br>
DHE-RSA-CAMELLIA256-SHA     SSLv3   Kx=DH       Au=RSA  Enc=Camellia(256) Mac=SHA1<br>
DHE-RSA-AES256-SHA          SSLv3   Kx=DH       Au=RSA  Enc=AES(256)      Mac=SHA1<br>
ECDHE-RSA-AES256-SHA        SSLv3   Kx=ECDH     Au=RSA  Enc=AES(256)      Mac=SHA1<br>
DHE-RSA-CAMELLIA128-SHA     SSLv3   Kx=DH       Au=RSA  Enc=Camellia(128) Mac=SHA1<br>
DHE-RSA-AES128-SHA          SSLv3   Kx=DH       Au=RSA  Enc=AES(128)      Mac=SHA1<br>
ECDHE-RSA-AES128-SHA        SSLv3   Kx=ECDH     Au=RSA  Enc=AES(128)      Mac=SHA1<br>
CAMELLIA256-SHA             SSLv3   Kx=RSA      Au=RSA  Enc=Camellia(256) Mac=SHA1<br>
AES256-SHA                  SSLv3   Kx=RSA      Au=RSA  Enc=AES(256)      Mac=SHA1<br>
CAMELLIA128-SHA             SSLv3   Kx=RSA      Au=RSA  Enc=Camellia(128) Mac=SHA1<br>
AES128-SHA                  SSLv3   Kx=RSA      Au=RSA  Enc=AES(128)      Mac=SHA1<br>
<br>
<br>
<a href="https://git.bettercrypto.org/ach-master.git/blob/HEAD:/src/common/cipherStringB.tex" rel="noreferrer" target="_blank">https://git.bettercrypto.org/ach-master.git/blob/HEAD:/src/common/cipherStringB.tex</a><br>
root@Sec-NS2:~# openssl ciphers -v 'EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA'<br>
DHE-RSA-AES256-GCM-SHA384   TLSv1.2 Kx=DH       Au=RSA  Enc=AESGCM(256)   Mac=AEAD<br>
DHE-RSA-AES256-SHA256       TLSv1.2 Kx=DH       Au=RSA  Enc=AES(256)      Mac=SHA256<br>
ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AESGCM(256)   Mac=AEAD<br>
ECDHE-RSA-AES256-SHA384     TLSv1.2 Kx=ECDH     Au=RSA  Enc=AES(256)      Mac=SHA384<br>
DHE-RSA-AES128-GCM-SHA256   TLSv1.2 Kx=DH       Au=RSA  Enc=AESGCM(128)   Mac=AEAD<br>
DHE-RSA-AES128-SHA256       TLSv1.2 Kx=DH       Au=RSA  Enc=AES(128)      Mac=SHA256<br>
ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AESGCM(128)   Mac=AEAD<br>
ECDHE-RSA-AES128-SHA256     TLSv1.2 Kx=ECDH     Au=RSA  Enc=AES(128)      Mac=SHA256<br>
DHE-RSA-CAMELLIA256-SHA     SSLv3   Kx=DH       Au=RSA  Enc=Camellia(256) Mac=SHA1<br>
DHE-RSA-AES256-SHA          SSLv3   Kx=DH       Au=RSA  Enc=AES(256)      Mac=SHA1<br>
ECDHE-RSA-AES256-SHA        SSLv3   Kx=ECDH     Au=RSA  Enc=AES(256)      Mac=SHA1<br>
DHE-RSA-CAMELLIA128-SHA     SSLv3   Kx=DH       Au=RSA  Enc=Camellia(128) Mac=SHA1<br>
DHE-RSA-AES128-SHA          SSLv3   Kx=DH       Au=RSA  Enc=AES(128)      Mac=SHA1<br>
ECDHE-RSA-AES128-SHA        SSLv3   Kx=ECDH     Au=RSA  Enc=AES(128)      Mac=SHA1<br>
CAMELLIA128-SHA             SSLv3   Kx=RSA      Au=RSA  Enc=Camellia(128) Mac=SHA1<br>
AES128-SHA                  SSLv3   Kx=RSA      Au=RSA  Enc=AES(128)      Mac=SHA1<br>
_______________________________________________<br>
Ach mailing list<br>
<a href="mailto:Ach@lists.cert.at" target="_blank">Ach@lists.cert.at</a><br>
<a href="http://lists.cert.at/cgi-bin/mailman/listinfo/ach" rel="noreferrer" target="_blank">http://lists.cert.at/cgi-bin/mailman/listinfo/ach</a><br>
</blockquote></div><br></div>