Is there any cipher suites supported in one TLS version and not supported in the other? If yes, then is there any documentation that talks about the cipher suites supported in each TLS or SSL versions?
1 Answer
Yes, the documentation you are looking for are the RFC documents for the various versions. Here are the links to the RFCs for TLS 1.0, 1.1, 1.2 and 1.3:
Since this would be a link-only answer, here the core of each RFC.
TLS 1.0
The chapter 9. Mandatory Cipher Suits reads the following:
In the absence of an application profile standard specifying otherwise, a TLS compliant application MUST implement the cipher suite
TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA.
This means that, unless and application profile says otherwise, a compliant application only has to implement TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA to be compliant to TLS 1.0. Of course, more ciphers were defined by TLS 1.0, and implementations were free to include even more, but to be TLS 1.0 compliant, this was the absolute minimum.
A complete list of all TLS 1.0 standardized ciphers is found in Appendix C. CipherSuite definitions:
CipherSuite Is Key Cipher Hash Exportable Exchange TLS_NULL_WITH_NULL_NULL * NULL NULL NULL TLS_RSA_WITH_NULL_MD5 * RSA NULL MD5 TLS_RSA_WITH_NULL_SHA * RSA NULL SHA TLS_RSA_EXPORT_WITH_RC4_40_MD5 * RSA_EXPORT RC4_40 MD5 TLS_RSA_WITH_RC4_128_MD5 RSA RC4_128 MD5 TLS_RSA_WITH_RC4_128_SHA RSA RC4_128 SHA TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 * RSA_EXPORT RC2_CBC_40 MD5 TLS_RSA_WITH_IDEA_CBC_SHA RSA IDEA_CBC SHA TLS_RSA_EXPORT_WITH_DES40_CBC_SHA * RSA_EXPORT DES40_CBC SHA TLS_RSA_WITH_DES_CBC_SHA RSA DES_CBC SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA RSA 3DES_EDE_CBC SHA TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA * DH_DSS_EXPORT DES40_CBC SHA TLS_DH_DSS_WITH_DES_CBC_SHA DH_DSS DES_CBC SHA TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA DH_DSS 3DES_EDE_CBC SHA TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA * DH_RSA_EXPORT DES40_CBC SHA TLS_DH_RSA_WITH_DES_CBC_SHA DH_RSA DES_CBC SHA TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA DH_RSA 3DES_EDE_CBC SHA TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA * DHE_DSS_EXPORT DES40_CBC SHA TLS_DHE_DSS_WITH_DES_CBC_SHA DHE_DSS DES_CBC SHA TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA DHE_DSS 3DES_EDE_CBC SHA TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA * DHE_RSA_EXPORT DES40_CBC SHA TLS_DHE_RSA_WITH_DES_CBC_SHA DHE_RSA DES_CBC SHA TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA DHE_RSA 3DES_EDE_CBC SHA TLS_DH_anon_EXPORT_WITH_RC4_40_MD5 * DH_anon_EXPORT RC4_40 MD5 TLS_DH_anon_WITH_RC4_128_MD5 DH_anon RC4_128 MD5 TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA DH_anon DES40_CBC SHA TLS_DH_anon_WITH_DES_CBC_SHA DH_anon DES_CBC SHA TLS_DH_anon_WITH_3DES_EDE_CBC_SHA DH_anon 3DES_EDE_CBC SHA TLS 1.1
Similarly to TLS 1.0, TLS 1.1 defines in chapter 9. Mandatory Cipher Suits the following:
In the absence of an application profile standard specifying otherwise, a TLS compliant application MUST implement the cipher suite
TLS_RSA_WITH_3DES_EDE_CBC_SHA.
Again, the complete list of all standardized ciphers is found again in Appendix C. CipherSuite Definitions:
CipherSuite Key Exchange Cipher Hash TLS_NULL_WITH_NULL_NULL NULL NULL NULL TLS_RSA_WITH_NULL_MD5 RSA NULL MD5 TLS_RSA_WITH_NULL_SHA RSA NULL SHA TLS_RSA_WITH_RC4_128_MD5 RSA RC4_128 MD5 TLS_RSA_WITH_RC4_128_SHA RSA RC4_128 SHA TLS_RSA_WITH_IDEA_CBC_SHA RSA IDEA_CBC SHA TLS_RSA_WITH_DES_CBC_SHA RSA DES_CBC SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA RSA 3DES_EDE_CBC SHA TLS_DH_DSS_WITH_DES_CBC_SHA DH_DSS DES_CBC SHA TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA DH_DSS 3DES_EDE_CBC SHA TLS_DH_RSA_WITH_DES_CBC_SHA DH_RSA DES_CBC SHA TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA DH_RSA 3DES_EDE_CBC SHA TLS_DHE_DSS_WITH_DES_CBC_SHA DHE_DSS DES_CBC SHA TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA DHE_DSS 3DES_EDE_CBC SHA TLS_DHE_RSA_WITH_DES_CBC_SHA DHE_RSA DES_CBC SHA TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA DHE_RSA 3DES_EDE_CBC SHA TLS_DH_anon_WITH_RC4_128_MD5 DH_anon RC4_128 MD5 TLS_DH_anon_WITH_DES_CBC_SHA DH_anon DES_CBC SHA TLS_DH_anon_WITH_3DES_EDE_CBC_SHA DH_anon 3DES_EDE_CBC SHA TLS 1.2
Chapter 9. Mandatory Cipher Suits again tells us the minimum required supported ciphersuites for TLS 1.2:
In the absence of an application profile standard specifying otherwise, a TLS-compliant application MUST implement the cipher suite
TLS_RSA_WITH_AES_128_CBC_SHA(see Appendix A.5 for the definition).
The complete list can be found again in Appendix C. CipherSuite Definitions:
Cipher Suite Key Cipher Mac Exchange TLS_NULL_WITH_NULL_NULL NULL NULL NULL TLS_RSA_WITH_NULL_MD5 RSA NULL MD5 TLS_RSA_WITH_NULL_SHA RSA NULL SHA TLS_RSA_WITH_NULL_SHA256 RSA NULL SHA256 TLS_RSA_WITH_RC4_128_MD5 RSA RC4_128 MD5 TLS_RSA_WITH_RC4_128_SHA RSA RC4_128 SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA RSA 3DES_EDE_CBC SHA TLS_RSA_WITH_AES_128_CBC_SHA RSA AES_128_CBC SHA TLS_RSA_WITH_AES_256_CBC_SHA RSA AES_256_CBC SHA TLS_RSA_WITH_AES_128_CBC_SHA256 RSA AES_128_CBC SHA256 TLS_RSA_WITH_AES_256_CBC_SHA256 RSA AES_256_CBC SHA256 TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA DH_DSS 3DES_EDE_CBC SHA TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA DH_RSA 3DES_EDE_CBC SHA TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA DHE_DSS 3DES_EDE_CBC SHA TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA DHE_RSA 3DES_EDE_CBC SHA TLS_DH_anon_WITH_RC4_128_MD5 DH_anon RC4_128 MD5 TLS_DH_anon_WITH_3DES_EDE_CBC_SHA DH_anon 3DES_EDE_CBC SHA TLS_DH_DSS_WITH_AES_128_CBC_SHA DH_DSS AES_128_CBC SHA TLS_DH_RSA_WITH_AES_128_CBC_SHA DH_RSA AES_128_CBC SHA TLS_DHE_DSS_WITH_AES_128_CBC_SHA DHE_DSS AES_128_CBC SHA TLS_DHE_RSA_WITH_AES_128_CBC_SHA DHE_RSA AES_128_CBC SHA TLS_DH_anon_WITH_AES_128_CBC_SHA DH_anon AES_128_CBC SHA TLS_DH_DSS_WITH_AES_256_CBC_SHA DH_DSS AES_256_CBC SHA TLS_DH_RSA_WITH_AES_256_CBC_SHA DH_RSA AES_256_CBC SHA TLS_DHE_DSS_WITH_AES_256_CBC_SHA DHE_DSS AES_256_CBC SHA TLS_DHE_RSA_WITH_AES_256_CBC_SHA DHE_RSA AES_256_CBC SHA TLS_DH_anon_WITH_AES_256_CBC_SHA DH_anon AES_256_CBC SHA TLS_DH_DSS_WITH_AES_128_CBC_SHA256 DH_DSS AES_128_CBC SHA256 TLS_DH_RSA_WITH_AES_128_CBC_SHA256 DH_RSA AES_128_CBC SHA256 TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 DHE_DSS AES_128_CBC SHA256 TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 DHE_RSA AES_128_CBC SHA256 TLS_DH_anon_WITH_AES_128_CBC_SHA256 DH_anon AES_128_CBC SHA256 TLS_DH_DSS_WITH_AES_256_CBC_SHA256 DH_DSS AES_256_CBC SHA256 TLS_DH_RSA_WITH_AES_256_CBC_SHA256 DH_RSA AES_256_CBC SHA256 TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 DHE_DSS AES_256_CBC SHA256 TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 DHE_RSA AES_256_CBC SHA256 TLS_DH_anon_WITH_AES_256_CBC_SHA256 DH_anon AES_256_CBC SHA256 TLS 1.3
TLS 1.3 is a bit more demanding with minimum requirements. Chapter 9. Compliance Requirements again states what an application needs to implement at minimum to be compliant to TLS 1.3, but it's more than a single cipher suite.
In the absence of an application profile standard specifying otherwise:
A TLS-compliant application MUST implement the
TLS_AES_128_GCM_SHA256cipher suite and SHOULD implement theTLS_AES_256_GCM_SHA384andTLS_CHACHA20_POLY1305_SHA256cipher suites (see Appendix B.4).A TLS-compliant application MUST support digital signatures with
rsa_pkcs1_sha256(for certificates),rsa_pss_rsae_sha256(for CertificateVerify and certificates), andecdsa_secp256r1_sha256. A TLS-compliant application MUST support key exchange withsecp256r1(NIST P-256) and SHOULD support key exchange withX25519.
Furthermore, chapter 9.2. Mandatory-to-Implement Extensions lists many mandatory extensions that a TLS 1.3 compliant application must implement. These are too many to list here, but the RFC is linked at the top of the question if you want to see those yourself.
Finally, the Appendix B.4 Cipher Suites defines the following Cipher Suites:
+------------------------------+-------------+ | Description | Value | +------------------------------+-------------+ | TLS_AES_128_GCM_SHA256 | {0x13,0x01} | | | | | TLS_AES_256_GCM_SHA384 | {0x13,0x02} | | | | | TLS_CHACHA20_POLY1305_SHA256 | {0x13,0x03} | | | | | TLS_AES_128_CCM_SHA256 | {0x13,0x04} | | | | | TLS_AES_128_CCM_8_SHA256 | {0x13,0x05} | +------------------------------+-------------+ As you can see, this list has been reduced quite a lot. Turns out supporting a ton of cipher suites with questionable security is not a great idea.
- 1There are lots of ciphersuites defined for TLS1.0-1.2 by RFCs other than the base RFCs; see 3268 4132 5932 6367 4279 4785 5487 5489 4492 8422 5054 4162 5288 5289 6655 7251 7905 6209 and maybe more I've missed. OTOH RC4 is in all 3 base RFCs but removed by 7465, AFAIK there are no additions or changes to 1.3 suites yet, but there probably will be, especially if anyone important standardizes post-quantum.dave_thompson_085– dave_thompson_0852019-07-18 04:30:40 +00:00Commented Jul 18, 2019 at 4:30
- @dave_thompson_085 Feel free to add them. I felt that the question was about base TLS, and if taken literally, then the answer would just be the absolute minimum cipher.user163495– user1634952019-07-18 07:26:02 +00:00Commented Jul 18, 2019 at 7:26