Re: SSL connection issues, cipher questions

[Scott Klement <midrange-l@xxxxxxxxxxxxxxxx>]

This is a difficult question to answer, because things aren't as simple 
as "secure" or "not secure".  Instead, there's a wide spectrum of 
varying degrees of ease of cracking the cryptography.

To put it another way: It's not all black or white, there are many 
shades of gray in between.

My opinion:  This cipher uses an RSA non-ephemeral key exchange, and has 
a 128-bit key.  128-bit key is relatively weak by today's standards, and 
once broken the entire conversation will be completely visible to the 
attacker.  I would not call this secure by today's standards.

By contrast, if you used a Diffie-Hellman ephemeral (DHE) key exchange, 
and the key is compromised, they'll only be able to see a part of the 
conversation because the key will change periodically.  So this is more 
secure. Even better would be to use a 256 bit key.

But, it really depends on how big of a risk you're willing to take, how 
crucial your data is, etc.

I wonder why you don't just use a stronger cipher and be done with it?


On 1/27/2022 1:56 PM, Steinmetz, Paul via MIDRANGE-L wrote:
> IBM is stating that TLS 1.2 cipher RSA_AES_128_GCM_SHA256 is safe and secure, can be used.
>
> According to site ciphersuite.info it is weak, should be removed.
> https://ciphersuite.info/search/?q=RSA_AES_128_GCM_SHA256
>
> One of our main apps uses this cipher.
> Our IT folks are asking I remove it, IBM states its ok.
>
> How does one deal with conflicting statements regarding ciphers?
>
> Paul