Comparison of TLS implementations

From Infogalactic: the planetary knowledge core
Jump to: navigation, search

The Transport Layer Security (TLS) protocol provides the ability to secure communications across networks. This comparison of TLS implementations compares several of the most notable libraries. There are several TLS implementations which are free software and open source.

All comparison categories use the stable version of each implementation listed in the overview section. The comparison is limited to features that directly relate to the TLS protocol.

Overview

Implementation Developed by Open source Software license Copyright owner Written in Latest stable version, release date Origin
Botan Jack Lloyd Yes Simplified BSD License Jack Lloyd C++ 1.11.29 (March 20, 2016; 8 years ago (2016-03-20)[1]) [±]

1.10.12 (February 3, 2016; 8 years ago (2016-02-03)[2]) [±]

 US (Vermont)
Bouncy Castle The Legion of the Bouncy Castle Inc. Yes MIT License Legion of the Bouncy Castle Inc. Java, C# 1.54 (Java) (December 30, 2015; 8 years ago (2015-12-30) [3]) [±]

1.8.1 (C#) (December 28, 2015; 8 years ago (2015-12-28) [4]) [±]

 Australia
cryptlib Peter Gutmann Yes Sleepycat License and commercial license Peter Gutmann C 3.4.3 (March 25, 2016; 8 years ago (2016-03-25) [5]) [±] NZ
GnuTLS GnuTLS project Yes GNU LGPLv2.1+ Free Software Foundation C 3.4.8 (January 8, 2016; 8 years ago (2016-01-08) [6]) [±]

3.3.20 (January 8, 2016; 8 years ago (2016-01-08) [6]) [±]

 EU (Greece and Sweden)
Java Secure Socket Extension (JSSE) Oracle Yes GNU GPLv2 and commercial license Oracle Java JDK 8, 2014-03-18 US
LibreSSL OpenBSD Project Yes Apache License 1.0, 4-clause BSD License, ISC License, and some are public domain Eric Young, Tim Hudson, Sun, OpenSSL project, OpenBSD Project, and others C, assembly 2.3.4 (May 3, 2016; 7 years ago (2016-05-03)[7]) [±]

2.2.7 (May 3, 2016; 7 years ago (2016-05-03)[7]) [±]

 Canada
MatrixSSL[8] PeerSec Networks Yes GNU GPLv2+ and commercial license PeerSec Networks C 3.7.2b (July 13, 2015; 8 years ago (2015-07-13) [9]) [±] US
mbed TLS (previously PolarSSL) ARM Yes Apache License 2.0, GNU GPLv2+ and commercial license ARM Holdings C 2.2.1 (January 4, 2016; 8 years ago (2016-01-04) [10]) [±]

2.1.4 (January 4, 2016; 8 years ago (2016-01-04) [10]) [±]
1.3.16 (January 4, 2016; 8 years ago (2016-01-04) [10]) [±]
1.2.19 (January 4, 2016; 8 years ago (2016-01-04) [10]) [±]

 EU (Netherlands)
Network Security Services (NSS) Mozilla, AOL, Red Hat, Sun, Oracle, Google and others Yes MPL 2.0 NSS contributors C, assembly 3.24 (May 23, 2016; 7 years ago (2016-05-23)[11]) [±]

3.22.3 (March 14, 2016; 8 years ago (2016-03-14)[12]) [±]
3.21.1 (March 8, 2016; 8 years ago (2016-03-08)[13]) [±]
3.19.2.4 (March 21, 2016; 8 years ago (2016-03-21)[14]) [±]

 US
OpenSSL OpenSSL project Yes OpenSSL-SSLeay dual-license Eric Young, Tim Hudson, Sun, OpenSSL project, and others C, assembly 1.0.2h (May 3, 2016; 7 years ago (2016-05-03)[15]) [±]

1.0.1t (May 3, 2016; 7 years ago (2016-05-03)[15]) [±]

 Australia/EU
RSA BSAFE RSA Security No[16] Proprietary RSA, The Security Division of EMC MES: 4.0[17]
SSL-J: 6.1.4[17]		 Australia
SChannel Microsoft No Proprietary Microsoft Inc. Windows 10, 2015-07-29 US
Secure Transport Apple Inc. Yes APSL 2.0 Apple Inc. 57337.20.44 (OS X 10.11.2), 2015-12-08 US
SharkSSL Realtimelogic LLC[18] No Proprietary Realtimelogic LLC C, assembly 3839 March 2016 US
TLSe Eduard Suica Yes Public domain Eduard Suica C 0.9, 2016-04-02 EU (Romania)
wolfSSL (previously CyaSSL) wolfSSL[19] Yes GNU GPLv2+ and commercial license wolfSSL Inc.[20] C 3.9.0 (March 18, 2016; 8 years ago (2016-03-18)[21]) [±] US
Implementation Developed by Open source Software license Copyright owner Written in Latest stable version, release date Origin

Protocol support

Several versions of the TLS protocol exist. SSL 2.0 is a deprecated[22] protocol version with significant weaknesses. SSL 3.0 (1996) and TLS 1.0 (1999) are successors with two weaknesses in CBC-padding that were explained in 2001 by Serge Vaudenay.[23] TLS 1.1 (2006) fixed only one of the problems, by switching to random IVs for CBC block ciphers, whereas the more problematic use of mac-pad-encrypt instead of the secure pad-mac-encrypt was addressed with RFC7366.[24] A workaround for SSL 3.0 and TLS 1.0, roughly equivalent to random IVs from TLS 1.1, was widely adopted by many implementations in late 2011,[25] so from a security perspective, all existing version of TLS 1.0, 1.1 and 1.2 provide equivalent strength in the base protocol and are suitable for 128-bit security according to NIST SP800-57 up to at least 2030. In 2014, the POODLE vulnerability of SSL 3.0 was discovered, which takes advantage the known vulnerabilities in CBC, and an insecure fallback negotiation used in browsers.[26]

TLS 1.2 (2008) is the latest published version of the base protocol, introducing a means to identify the hash used for digital signatures. While permitting the use of stronger hash functions for digital signatures in the future (rsa,sha256/sha384/sha512) over the SSL 3.0 conservative choice (rsa,sha1+md5), the TLS 1.2 protocol change inadvertently and substantially weakened the default digital signatures and provides (rsa,sha1) and even (rsa,md5).[27]

Datagram Transport Layer Security (DTLS or Datagram TLS) 1.0 is a modification of TLS 1.1 for a packet-oriented transport layer, where packet loss and packet reordering have to be tolerated. The revision DTLS 1.2 based on TLS 1.2 was published in January 2012[28]

Note that there are known vulnerabilities in SSL 2.0 and SSL 3.0. With the exception of the predictable IVs (for which an easy workaround exists) all currently known vulnerabilities affect all version of TLS 1.0/1.1/1.2 alike.[29]

Implementation SSL 2.0 (insecure)[30] SSL 3.0 (insecure)[31] TLS 1.0[32] TLS 1.1[33] TLS 1.2[34] TLS 1.3
(Draft)[35][36]		 DTLS 1.0[37] DTLS 1.2[28]
Botan No No[38] Yes Yes Yes Yes Yes
cryptlib No Disabled by default at compile time Yes Yes Yes No No
GnuTLS No[a] Disabled by default[39] Yes Yes Yes Yes Yes
JSSE No[a] Disabled by default[b] Yes Yes Yes No No
LibreSSL No[40] No[41] Yes Yes Yes Yes No
MatrixSSL No[a] Disabled by default at compile time[42] Yes Yes Yes Yes Yes
mbed TLS No Disabled by default[43] Yes Yes Yes Yes[43] Yes[43]
NSS Disabled by default[a] Disabled by default[44] Yes Yes[45] Yes[46] Yes[45] Yes[47]
OpenSSL Disabled by default[48] Enabled by default Yes Yes[49] Yes[49] Yes Yes[50]
RSA BSAFE[51] No Yes Yes Yes Yes No No
SChannel XP, 2003[52] Disabled by default in MSIE 7 Enabled by default Enabled by default in MSIE 7 No No No No
SChannel Vista, 2008[53] Disabled by default Enabled by default Yes No No No No
SChannel 7, 2008R2[54] Disabled by default Disabled by default in MSIE 11 Yes Enabled by default in MSIE 11 Enabled by default in MSIE 11 Yes[55] No[55]
SChannel 8, 2012[54] Disabled by default Enabled by default Yes Disabled by default Disabled by default Yes No
SChannel 8.1, 2012R2, 10[54] Disabled by default Disabled by default in MSIE 11 Yes Yes Yes Yes No
Secure Transport OS X 10.2-10.8, iOS 1-4 Yes Yes Yes No No No No
Secure Transport OS X 10.9-10.10, iOS 5-8 No[c] Yes Yes Yes[c] Yes[c] Yes[c] No
Secure Transport OS X 10.11, iOS 9 No[c] No[c] Yes Yes[c] Yes[c] Yes[c] Unknown
SharkSSL No Disabled by default Yes Yes Yes No No
TLSe No No Yes Yes Yes No No
wolfSSL No Disabled by default[56] Yes Yes Yes Yes Yes
Implementation SSL 2.0 (insecure) SSL 3.0 (insecure) TLS 1.0 TLS 1.1 TLS 1.2 TLS 1.3
(Draft)		 DTLS 1.0 DTLS 1.2
  1. ^ SSL 2.0 client hello is supported even though SSL 2.0 is not supported or is disabled because of the backward compatibilities.
  2. ^ SSL 3.0 support has been disabled by default as of Java 8 update 31.[57]
  3. ^ Secure Transport: SSL 2.0 was discontinued in OS X 10.8. SSL 3.0 was discontinued in OS X 10.11 and iOS 9.TLS 1.1, 1.2 and DTLS are available on iOS 5.0 and later, and OS X 10.8 and later.[58][59]

NSA Suite B Cryptography

Required components for NSA Suite B Cryptography (RFC 6460) are:

Per CNSSP-15, the 256-bit elliptic curve (specified in FIPS 186-2), SHA-256, and AES with 128-bit keys are sufficient for protecting classified information up to the Secret level, while the 384-bit elliptic curve (specified in FIPS 186-2), SHA-384, and AES with 256-bit keys are necessary for the protection of Top Secret information.

Implementation TLS 1.2 Suite B
Botan Yes
cryptlib Yes
GnuTLS Yes
JSSE Yes[60]
LibreSSL Yes
MatrixSSL Yes
mbed TLS Yes
NSS No[61]
OpenSSL Yes[50]
RSA BSAFE Yes[51]
SChannel Yes[62]
Secure Transport No
SharkSSL Yes
TLSe Yes
wolfSSL Yes
Implementation TLS 1.2 Suite B

Certifications

Note that certain certifications have received serious negative criticism from people who are actually involved in them.[63]

Implementation FIPS 140-1, FIPS 140-2[64] Common Criteria
Level 1 Level 2[disputed – discuss]
Botan[65]
cryptlib[66]
GnuTLS[67] no support
JSSE
LibreSSL[40] no support
MatrixSSL[68] SafeZone FIPS Cryptographic Module: 1.1 (#2389)
mbed TLS[69]
NSS[70] Network Security Services: 3.2.2 (#247)
Network Security Services Cryptographic Module: 3.11.4 (#815), 3.12.4 (#1278), 3.12.9.1 (#1837)		 Netscape Security Module: 1 (#7[notes 1]), 1.01 (#47[notes 2])
Network Security Services: 3.2.2 (#248[notes 3])
Network Security Services Cryptographic Module: 3.11.4 (#814[notes 4]), 3.12.4 (#1279, #1280[notes 5])
OpenSSL[71] OpenSSL FIPS Object Module: 1.0 (#624), 1.1.1 (#733), 1.1.2 (#918), 1.2, 1.2.1, 1.2.2, 1.2.3 or 1.2.4 (#1051)
2.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7 or 2.0.8 (#1747)
RSA BSAFE[72] Crypto-C ME 3.0.0.1, 4.0.1, 4.1 (#2294, #2300)
Crypto-J 6.1 (#2057, #2058)
SChannel[73] Cryptographic modules in Windows NT 4.0, 95, 95, 2000, XP, Server 2003, CE 5, CE 6, Mobile 6.x, Vista, Server 2008, 7, Server 2008 R2, 8, Server 2012, RT, Surface, Phone 8
See details on Microsoft FIPS 140 Validated Cryptographic Modules
Secure Transport Apple FIPS Cryptographic Module: 1.0 (OS X 10.6, #1514), 1.1 (OS X 10.7, #1701)
Apple OS X CoreCrypto Module; CoreCrypto Kernel Module: 3.0 (OS X 10.8, #1964, #1956), 4.0 (OS X 10.9, #2015, #2016)
Apple iOS CoreCrypto Module; CoreCrypto Kernel Module: 3.0 (iOS 6, #1963, #1944), 4.0 (iOS 7 , #2020, #2021)
SharkSSL
TLSe
wolfSSL[74] wolfCrypt FIPS Module: 3.6.0 (#2425)
Implementation Level 1 Level 2 Common Criteria
FIPS 140-1, FIPS 140-2
  1. ↑ with Sun Sparc 5 w/ Sun Solaris v 2.4SE (ITSEC-rated)
  2. ↑ with Sun Ultra-5 w/ Sun Trusted Solaris version 2.5.1 (ITSEC-rated)
  3. ↑ with Solaris v8.0 with AdminSuite 3.0.1 as specified in UK IT SEC CC Report No. P148 EAL4 on a SUN SPARC Ultra-1
  4. ↑ with these platforms; Red Hat Enterprise Linux Version 4 Update 1 AS on IBM xSeries 336 with Intel Xeon CPU, Trusted Solaris 8 4/01 on Sun Blade 2500 Workstation with UltraSPARC IIIi CPU
  5. ↑ with these platforms; Red Hat Enterprise Linux v5 running on an IBM System x3550, Red Hat Enterprise Linux v5 running on an HP ProLiant DL145, Sun Solaris 10 5/08 running on a Sun SunBlade 2000 workstation, Sun Solaris 10 5/08 running on a Sun W2100z workstation

Key exchange algorithms (certificate-only)

This section lists the certificate verification functionality available in the various implementations.

Implementation RSA[34] RSA-EXPORT (insecure)[34] DHE-RSA (forward secrecy)[34] DHE-DSS (forward secrecy)[34] ECDH-ECDSA[75] ECDHE-ECDSA (forward secrecy)[75] ECDH-RSA[75] ECDHE-RSA (forward secrecy)[75] GOST R 34.10-94, 34.10-2001[76]
Botan Yes No Yes Yes No Yes No Yes Yes[77]
cryptlib Yes No Yes Yes No Yes No No No
GnuTLS Yes No Yes Disabled by default[39] No Yes No Yes No
JSSE Yes Disabled by default Max 2048 bit Max 2048 bit Yes Yes Yes Yes No[78]
LibreSSL Yes No[40] Yes Yes Yes Yes Yes Yes Yes[79]
MatrixSSL Yes No Yes No Yes Yes Yes Yes No
mbed TLS Yes No Yes No Yes Yes Yes Yes No
NSS Yes Disabled by default Yes[80] Yes Yes Yes Yes Yes No[81][82]
OpenSSL Yes Disabled by default[83] Yes Yes Yes Yes Yes Yes Yes[84]
RSA BSAFE[51] Yes No Yes Yes Yes Yes Yes Yes No
SChannel XP/2003 Yes Yes No XP: Max 1024 bits
2003: 1024 bits only		 No No No No No[85]
SChannel Vista/2008, 2008R2, 2012 Yes Disabled by default No 1024 bits only No Yes No except AES_GCM No[85]
SChannel 7, 8, 8.1/2012R2 Yes Disabled by default AES_GCM only
Client: 1024-4096bits(or more?)
Server: 1024bits only[86][87][88]		 1024 bits only No Yes No except AES_GCM No[85]
SChannel 10 Yes Disabled by default AES_GCM only
Client: 1024-4096bits(or more?)
Server: 2048bits only		 1024 bits only No Yes No Yes No[85]
Secure Transport OS X 10.6 Yes Yes except AES_GCM Yes Yes except AES_GCM Yes except AES_GCM No
Secure Transport OS X 10.8-10.10 Yes No except AES_GCM No Yes except AES_GCM Yes except AES_GCM No
Secure Transport OS X 10.11 Yes No Yes No No Yes No Yes No
SharkSSL Yes No Yes No Yes Yes Yes Yes No
TLSe Yes No Yes No No Yes No Yes No
wolfSSL Yes No Yes No Yes Yes Yes Yes No
Implementation RSA RSA EXPORT (insecure) DHE-RSA (forward secrecy) DHE-DSS (forward secrecy) ECDH-ECDSA ECDHE-ECDSA (forward secrecy) ECDH-RSA ECDHE-RSA (forward secrecy) GOST R 34.10-94, 34.10-2001

Key exchange algorithms (alternative key-exchanges)

Implementation SRP[89] SRP-DSS[89] SRP-RSA[89] PSK-RSA[90] PSK[90] DHE-PSK (forward secrecy)[90] ECDHE-PSK (forward secrecy)[91] KRB5[92] DH-ANON[34] (insecure) ECDH-ANON[75] (insecure)
Botan Yes Yes Yes No Yes Yes Yes No Yes Yes
cryptlib No No No No Yes Yes No Unknown No No
GnuTLS Yes Yes Yes Yes Yes Yes Yes No Disabled by default Disabled by default
JSSE No No No No No No No Unknown Disabled by default in Java 8 Disabled by default in Java 8
LibreSSL No[93] No[93] No[93] No No No No No Yes Yes
MatrixSSL No No No Yes Yes Yes No No Disabled by default No
mbed TLS No No No Yes Yes Yes Yes No No No
NSS No[94] No[94] No[94] No[95] No[95] No[95] No[95] No Client side only, disabled by default[96] Disabled by default[97]
OpenSSL Yes Yes Yes No Yes No No Yes[98] Disabled by default[48] Disabled by default[48]
RSA BSAFE[51] No No No No No No No Unknown Yes Yes
SChannel No No No No No No No Yes No No
Secure Transport No No No No No No No Unknown Yes Yes
SharkSSL No No No No Yes No No Unknown No No
TLSe No No No No No No No No No No
wolfSSL No No No No Yes No Yes[99] No No No
Implementation SRP SRP-DSS SRP-RSA PSK-RSA PSK DHE-PSK (forward secrecy) ECDHE-PSK (forward secrecy) KRB5 DH-ANON (insecure) ECDH-ANON (insecure)

Certificate verification methods

Implementation Application-defined PKIX path validation[100] CRL[101] OCSP[102] DANE (DNSSEC)[103] Trust on First Use (TOFU)
Botan Yes Yes Yes Yes No No
cryptlib Yes Yes Unknown Unknown No No
GnuTLS Yes Yes Yes Yes Yes Yes
JSSE Yes Yes Yes Yes No No
LibreSSL Yes Yes Yes Yes No No
MatrixSSL Yes Yes Yes No No No
mbed TLS Yes Yes Yes Unknown No No
NSS Yes Yes Yes Yes No[104] No
OpenSSL Yes Yes Yes Yes No No
RSA BSAFE[51] Yes Yes Yes Yes No No
SChannel Unknown Yes Yes[105] Yes[105] No No
Secure Transport Yes Yes Yes Yes No No
SharkSSL Yes Yes No No No No
TLSe Yes Yes No No No No
wolfSSL Yes Yes Yes Yes No No
Implementation Application-defined PKIX CRL OCSP DANE TOFU

Encryption algorithms

Implementation Block cipher with mode of operation Stream cipher None
AES GCM
[106]		 AES CCM
[107]		 AES CBC Camellia GCM
[108]		 Camellia CBC
[109]		 ARIA GCM
[110]		 ARIA CBC
[110]		 SEED CBC
[111]		 3DES EDE CBC GOST 28147-89 CNT
(proposed)
[76][n 1]		 ChaCha20-Poly1305
(proposed)
[112][n 1]		 Null
(insecure)
[n 2]
Botan Yes Yes Yes Yes Yes No No Yes Yes Yes[113] Yes[114] Disabled by default
cryptlib Yes No Yes No No No No No Yes No No Disabled by default
GnuTLS Yes Yes[39] Yes Yes Yes No No No Yes No Yes[115] Disabled by default
JSSE Yes No Yes No No No No No Yes No[78] No Disabled by default
LibreSSL Yes[40] No Yes No Yes[79] No No No[40] Yes Yes[79] Yes[40] Disabled by default
MatrixSSL Yes No Yes No No No No Yes Disabled by default No No Disabled by default
mbed TLS Yes Yes [116] Yes Yes Yes No No No Yes No No Disabled by default at compile time
NSS 128 bit only[117][118] No Yes No[119][n 3] Yes[120] No No Yes[121] Yes No[81][82] Yes[122] Disabled by default
OpenSSL Yes[123] No Yes No Yes No No Yes Yes Yes[84] Beta[125] Disabled by default
RSA BSAFE MES[51] Yes Yes Yes No No No No No Yes No No Disabled by default
RSA BSAFE SSL-J[51] Yes No Yes No No No No No Yes No No Disabled by default
SChannel XP/2003 No No 2003 only[126] No No No No No Yes No[85] No Disabled by default
SChannel Vista/2008, 2008R2, 2012 No No Yes No No No No No Yes No[85] No Disabled by default
SChannel 7, 8, 8.1/2012R2 Yes except ECDHE_RSA
[86][87]		 No Yes No No No No No Yes No[85] No Disabled by default
Schannel 10[127] Yes No Yes No No No No No Yes No[85] No Disabled by default
Secure Transport OS X 10.6 - 10.10 No No Yes No No No No No Yes No No Disabled by default
Secure Transport OS X 10.11 Yes No Yes No No No No No Yes No No Disabled by default
SharkSSL Yes Yes Yes No No No No No Yes No Yes Disabled by default
TLSe Yes No Yes No No No No No No No No No
wolfSSL Yes Yes Yes No Yes No No No Yes No Yes Disabled by default
Implementation AES GCM AES CCM AES CBC Camellia GCM Camellia CBC ARIA GCM ARIA CBC SEED CBC 3DES EDE CBC GOST 28147-89 CNT
(proposed)		 ChaCha20-Poly1305
(proposed)		 Null
(insecure)
Block cipher with mode of operation Stream cipher None
Notes
  1. ↑ 1.0 1.1 This algorithm is not defined yet as TLS cipher suites in RFCs, is proposed in drafts.
  2. ↑ authentication only, no encryption
  3. ↑ This algorithm is implemented in an NSS fork used by Pale Moon.

Obsolete algorithms

Implementation Block cipher with mode of operation Stream cipher
IDEA CBC
[n 1]		 DES CBC
(insecure)
[n 1]		 DES-40 CBC
(EXPORT, insecure)
[n 2]		 RC2-40 CBC
(EXPORT, insecure)
[n 2]		 RC4-128
(insecure)
[n 3]		 RC4-40
(EXPORT, insecure)
[n 4][n 2]
Botan No No No Disabled by default No[129] No
cryptlib No Disabled by default at compile time No No Disabled by default at compile time No
GnuTLS No No No No Disabled by default[39] No
JSSE No Disabled by default Disabled by default No Yes Disabled by default [130]
LibreSSL Yes Yes No[40] No[40] Yes No[40]
MatrixSSL Yes No No No Disabled by default No
mbed TLS No Disabled by default at compile time No No Disabled by default at complile time[43] No
NSS Yes Disabled by default Disabled by default Disabled by default Lowest priority[131][132] Disabled by default
OpenSSL Yes Yes Disabled by default[83] Disabled by default[83] Yes Disabled by default[83]
RSA BSAFE MES[51] No No No No Yes No
RSA BSAFE SSL-J[51] No Yes Yes No Yes Yes
SChannel XP/2003 No Yes Yes Yes Yes Yes
SChannel Vista/2008 No Disabled by default Disabled by default Disabled by default Yes Disabled by default
SChannel 7/2008R2, 8/2012 No Disabled by default Disabled by default Disabled by default Lowest priority[87][n 5] Disabled by default
SChannel 8.1/2012R2 No Disabled by default Disabled by default Disabled by default Only as fallback[n 6][134][135] Disabled by default
Schannel 10[127] No Disabled by default Disabled by default Disabled by default Only as fallback[n 6] Disabled by default
Secure Transport OS X 10.6 Yes Yes Yes Yes Yes Yes
Secure Transport OS X 10.7 Yes Unknown Unknown Unknown Yes Unknown
Secure Transport OS X 10.8-10.9 Yes Disabled by default Disabled by default Disabled by default Yes Disabled by default
Secure Transport OS X 10.10-10.11 Yes Disabled by default Disabled by default Disabled by default Lowest priority Disabled by default
SharkSSL No Disabled by default No No Disabled by default No
TLSe No No No No No No
wolfSSL Yes[136] No No No Disabled by default No
Implementation IDEA CBC DES CBC
(insecure)		 DES-40 CBC
(EXPORT, insecure)		 RC2-40 CBC
(EXPORT, insecure)		 RC4-128
(insecure)		 RC4-40
(EXPORT, insecure)
Block cipher with mode of operation Stream cipher
Notes
  1. ↑ 1.0 1.1 IDEA and DES have been removed from TLS 1.2.[128]
  2. ↑ 2.0 2.1 2.2 40 bits strength of cipher suites were designed to operate at reduced key lengths in order to comply with US regulations about the export of cryptographic software containing certain strong encryption algorithms (see Export of cryptography from the United States). These weak suites are forbidden in TLS 1.1 and later.
  3. ↑ The RC4 attacks weaken or break RC4 used in SSL/TLS. Use of RC4 is prohibited by RFC 7465.
  4. ↑ The RC4 attacks weaken or break RC4 used in SSL/TLS.
  5. ↑ RC4 can be disabled except as a fallback (Only when no cipher suites with other than RC4 is available, cipher suites with RC4 will be used as a fallback.)[133]
  6. ↑ 6.0 6.1 Only when no cipher suites with other than RC4 is available, cipher suites with RC4 will be used as a fallback.

Supported elliptic curves

This section lists the supported elliptic curves by each implementation.

Implementation sect163k1
NIST K-163
(1)[75]		 sect163r1
(2)[75]		 sect163r2
NIST B-163
(3)[75]		 sect193r1
(4)[75]		 sect193r2
(5)[75]		 sect233k1
NIST K-233
(6)[75]		 sect233r1
NIST B-233
(7)[75]		 sect239k1
(8)[75]		 sect283k1
NIST K-283
(9)[75]		 sect283r1
NIST B-283
(10)[75]		 sect409k1
NIST K-409
(11)[75]		 sect409r1
NIST B-409
(12)[75]		 sect571k1
NIST K-571
(13)[75]		 sect571r1
NIST B-571
(14)[75]
Botan No No No No No No No No No No No No No No
GnuTLS No No No No No No No No No No No No No No
JSSE Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes
LibreSSL Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes
MatrixSSL No No No No No No No No No No No No No No
mbed TLS No No No No No No No No No No No No No No
NSS Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes
OpenSSL Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes
RSA BSAFE[51] Yes No Yes No No Yes Yes No Yes Yes Yes Yes Yes Yes
SChannel Vista/2008, 7/2008R2, 8/2012, 8.1/2012R2, 10 No No No No No No No No No No No No No No
Secure Transport No No No No No No No No No No No No No No
SharkSSL No No No No No No No No No No No No No No
TLSe No No No No No No No No No No No No No No
wolfSSL No No No No No No No No No No No No No No
Implementation sect163k1
NIST K-163
(1)		 sect163r1
(2)		 sect163r2
NIST B-163
(3)		 sect193r1
(4)		 sect193r2
(5)		 sect233k1
NIST K-233
(6)		 sect233r1
NIST B-233
(7)		 sect239k1
(8)		 sect283k1
NIST K-283
(9)		 sect283r1
NIST B-283
(10)		 sect409k1
NIST K-409
(11)		 sect409r1
NIST B-409
(12)		 sect571k1
NIST K-571
(13)		 sect571r1
NIST B-571
(14)
Implementation secp160k1
(15)[75]		 secp160r1
(16)[75]		 secp160r2
(17)[75]		 secp192k1
(18)[75]		 secp192r1
prime192v1
NIST P-192
(19)[75]		 secp224k1
(20)[75]		 secp224r1
NIST P-244
(21)[75]		 secp256k1
(22)[75]		 secp256r1
prime256v1
NIST P-256
(23)[75]		 secp384r1
NIST P-384
(24)[75]		 secp521r1
NIST P-521
(25)[75]		 arbitrary prime curves
(0xFF01)[75][137]		 arbitrary char2 curves
(0xFF02)[75][137]
Botan No No No No No No No No Yes Yes Yes No No
GnuTLS No No No No Yes No Yes No Yes Yes Yes No No
JSSE Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes No No
LibreSSL Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes No No
MatrixSSL No No No No Yes No Yes No Yes Yes Yes No No
mbed TLS No No No Yes Yes Yes Yes Yes Yes Yes Yes No No
NSS Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes No No
OpenSSL Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes No No
RSA BSAFE[51] No No No No Yes No Yes No Yes Yes Yes No No
SChannel Vista/2008, 7/2008R2, 8/2012, 8.1/2012R2, 10 No No No No No No No No Yes Yes Yes No No
Secure Transport No No No No Yes No No No Yes No Yes No No
SharkSSL No No No No Yes No Yes No Yes Yes Yes No No
TLSe No No No No No No Yes No Yes Yes Disabled No No
wolfSSL No Yes No No Yes No Yes No Yes Yes Yes No No
Implementation secp160k1
(15)		 secp160r1
(16)		 secp160r2
(17)		 secp192k1
(18)		 secp192r1
prime192v1
NIST P-192
(19)		 secp224k1
(20)		 secp224r1
NIST P-224
(21)		 secp256k1
(22)		 secp256r1
prime256v1
NIST P-256
(23)		 secp384r1
NIST P-384
(24)		 secp521r1
NIST P-521
(25)		 arbitrary prime curves
(0xFF01)		 arbitrary char2 curves
(0xFF02)
Implementation brainpoolP256r1
(26)[138]		 brainpoolP384r1
(27)[138]		 brainpoolP512r1
(28)[138]		 Curve25519
[139]		 Curve448
Ed448-Goldilocks
[139]		 M221
Curve2213
[140]		 E222
[140]		 Curve1174
[140]		 E382
[140]		 M383
[140]		 Curve383187
[140]		 Curve41417
Curve3617
[140]		 M511
Curve511187
[140]		 E521
[140]
Botan Yes[141] Yes[141] Yes[141] Yes[114] No No No No No No No No No No
GnuTLS No No No No No No No No No No No No No No
JSSE No No No No No No No No No No No No No No
LibreSSL Yes[40] Yes[40] Yes[40] No No No No No No No No No No No
MatrixSSL Yes Yes Yes No No No No No No No No No No No
mbed TLS Yes[142] Yes[142] Yes[142] Yes[143] No No No No No No No No No No
NSS No[144] No[144] No[144] No[145] No No No No No No No No No No
OpenSSL Yes[50] Yes[50] Yes[50] No No No No No No No No No No No
RSA BSAFE[51] No No No No No No No No No No No No No No
SChannel Vista/2008, 7/2008R2, 8/2012, 8.1/2012R2, 10 No No No No No No No No No No No No No No
Secure Transport No No No No No No No No No No No No No No
SharkSSL No No No No No No No No No No No No No No
TLSe No No No No No No No No No No No No No No
wolfSSL No No No Yes[146] No No No No No No No No No No
Implementation brainpoolP256r1
(26)		 brainpoolP384r1
(27)		 brainpoolP512r1
(28)		 Curve25519 Curve448
Ed448-Goldilocks		 M221
Curve2213		 E222 Curve1174 E382 M383 Curve383187 Curve41417
Curve3617		 M511
Curve511187		 E521

Data integrity

Implementation HMAC-MD5 HMAC-SHA1 HMAC-SHA256/384 AEAD GOST 28147-89 IMIT[76] GOST R 34.11-94[76]
Botan Yes Yes Yes Yes Yes[113] Yes[147]
cryptlib Yes Yes Yes Yes No No
GnuTLS Yes Yes Yes Yes No No
JSSE Yes Yes Yes Yes No[78] No[78]
LibreSSL Yes Yes Yes Yes Yes[79] Yes[79]
MatrixSSL Yes Yes Yes Yes No No
mbed TLS Yes Yes Yes Yes No No
NSS Yes Yes Yes Yes No[81][82] No[81][82]
OpenSSL Yes Yes Yes Yes Yes[84] Yes[84]
RSA BSAFE[51] Yes Yes Yes Yes No No
SChannel XP/2003, Vista/2008 Yes Yes XP SP3, 2003 SP2 via hotfix[148] No No[85] No[85]
SChannel 7/2008R2, 8/2012, 8.1/2012R2 Yes Yes Yes except ECDHE_RSA[86][87][88] No[85] No[85]
SChannel 10 Yes Yes Yes Yes[127] No[85] No[85]
Secure Transport Yes Yes Yes No No No
SharkSSL Yes Yes Yes Yes No No
TLSe Yes Yes Yes Yes No No
wolfSSL Yes Yes Yes Yes No No
Implementation HMAC-MD5 HMAC-SHA1 HMAC-SHA256/384 AEAD GOST 28147-89 IMIT GOST R 34.11-94

Compression

Note the CRIME security exploit takes advantage of TLS compression, so conservative implementations do not enable compression at the TLS level. HTTP compression is unrelated and unaffected by this exploit, but is exploited by the related BREACH attack.

Implementation DEFLATE[149]
(insecure)
Botan No
cryptlib No
GnuTLS Disabled by default
JSSE No
LibreSSL No[40]
MatrixSSL Disabled by default
mbed TLS Disabled by default
NSS Disabled by default
OpenSSL Disabled by default
RSA BSAFE[51] No
SChannel No
Secure Transport No
SharkSSL No
TLSe No
wolfSSL Disabled by default
Implementation DEFLATE

Extensions

In this section the extensions each implementation supports are listed. Note that the Secure Renegotiation extension is critical for HTTPS client security[citation needed]. TLS clients not implementing it are vulnerable to attacks, irrespective of whether the client implements TLS renegotiation.

Implementation Secure Renegotiation
[150]		 Server Name Indication
[151]		 ALPN
[152]		 Certificate Status Request
[151]		 OpenPGP
[153]		 Supplemental Data
[154]		 Session Ticket
[155]		 Keying Material Exporter
[156]		 Maximum Fragment Length
[151]		 Truncated HMAC
[151]		 Encrypt-then-MAC
[157]		 TLS Fallback SCSV
[158]		 Extended Master Secret
[159]		 TLS Padding
[160]
Botan Yes Yes No No No No Yes Yes Yes No No Yes[161] Yes[162] No
cryptlib Yes Yes No No No Yes No No No[163] No Yes Yes Yes No
GnuTLS Yes Yes Yes[164] Yes Yes Yes Yes Yes Yes No Yes[39] Yes[165] Yes[39] No
JSSE Yes Yes[60] Unknown No No No No No No No No No No No
LibreSSL Yes Yes Yes[166] Yes No No? Yes Yes? No No No Server side only[167] No Yes
MatrixSSL Yes Yes Yes[168] No No No Yes No Yes Yes No No No No
mbed TLS Yes Yes Yes[169] No No No Yes No Yes Disabled by default[43] Yes[170] Yes[170] Yes[170] No
NSS Yes Yes Yes[171] Yes No[172] No Yes Yes No No No[173] Yes[174] Yes[175] Yes[171]
OpenSSL Yes Yes Yes[50] Yes No No? Yes Yes? No No No Yes[176] No Yes[177]
RSA BSAFE MES[51] Yes Yes No Yes No No Yes No Yes Yes No No No No
RSA BSAFE SSL-J[51] Yes Yes No No No No No No Yes Yes No No No No
SChannel XP/2003 No No No No No Yes No No No No No No No No
SChannel Vista/2008 Yes Yes No No No Yes No No No No No No No No
SChannel 7/2008R2 Yes Yes No Yes No Yes No No No No No No No No
SChannel 8/2012 Yes Yes No Yes No Yes Client side only[178] No No No No No No No
SChannel 8.1/2012R2, 10 Yes Yes Yes Yes No Yes Yes[178] No No No No No No No
Secure Transport Yes Yes Unknown No No Yes No No No No No No No No
SharkSSL Yes No No No No No No No No No No No No No
TLSe Yes Yes No No No No No No No No No Yes No No
wolfSSL Yes Yes Yes[136] No No No Yes No Yes Yes No No No No
Implementation Secure Renegotiation Server Name Indication ALPN Certificate Status Request OpenPGP Supplemental Data Session Ticket Keying Material Exporter Maximum Fragment Length Truncated HMAC Encrypt-then-MAC TLS Fallback SCSV Extended Master Secret TLS Padding

Assisted cryptography

This section lists the known ability of an implementation to take advantage of CPU instruction sets that optimize encryption, or utilize system specific devices that allow access to underlying cryptographic hardware for acceleration or for data separation.

Implementation PKCS #11 device Intel AES-NI VIA PadLock STM32F2 Cavium NITROX Cavium OCTEON Freescale CAU/mmCAU ARMv8-A Microchip PIC32MZ Intel IPP TI TM4C12x
Botan No Yes No No No No No No No No No
cryptlib Yes Yes Yes No No No No No No No No
GnuTLS Yes Yes Yes No No No No No No No No
JSSE Yes Yes[179] No No No No No No No No No
LibreSSL No Yes Yes No Yes No No No No No No
MatrixSSL Yes Yes No No No No No Yes No No No
mbed TLS Yes Yes[180] Yes No No No No No No No No
NSS Yes[181] Yes[182] No[183] No No No No No No No No
OpenSSL No Yes Yes No Yes No No Yes[184] No No No
RSA BSAFE[51] Yes Yes No No No No No No No No No
SChannel No Yes No No No No No No No No No
Secure Transport No Yes[185][186] No No No No No Yes No No No
SharkSSL No No No Yes No No Yes No No No No
TLSe No No No No No No No No No No No
wolfSSL No Yes No Yes Yes Yes[187] Yes No Yes Yes Yes
Implementation PKCS #11 device Intel AES-NI VIA PadLock STM32F2 Cavium NITROX Cavium OCTEON Freescale CAU/mmCAU ARMv8-A Microchip PIC32MZ Intel IPP TI TM4C12x

System-specific backends

This section lists the ability of an implementation to take advantage of the available operating system specific backends, or even the backends provided by another implementation.

Implementation /dev/crypto Windows CSP CommonCrypto OpenSSL engine
Botan No No No No
cryptlib No No No No
GnuTLS Yes No No No
JSSE No Yes No No
LibreSSL Yes No No No[188]
MatrixSSL No No Yes Yes
mbed TLS No No No No
NSS No No No No
OpenSSL Yes No No Yes
RSA BSAFE[51] No No No No
SChannel No Yes No No
Secure Transport No No Yes No
SharkSSL No No No No
TLSe No No No No
wolfSSL No Partial No No
Implementation /dev/crypto Windows CSP CommonCrypto OpenSSL engine

Cryptographic module/token support

Implementation TPM support Hardware token support Objects identified via
Botan No No
cryptlib No PKCS11 User-defined label
GnuTLS Yes PKCS11 RFC7512 PKCS #11 URLs[189]
JSSE No PKCS11 Java Cryptography Architecture,
Java Cryptography Extension
LibreSSL Yes PKCS11 (via 3rd party module) Custom method
MatrixSSL No PKCS11
mbed TLS No PKCS11 (via libpkcs11-helper) or standard hooks Custom method
NSS No PKCS11
OpenSSL Yes PKCS11 (via 3rd party module) Custom method
RSA BSAFE MES[51] No PKCS11 (via 3rd party module) User-defined label
RSA BSAFE SSL-J[51] No No
SChannel No Microsoft CryptoAPI UUID, User-defined label
Secure Transport
SharkSSL No No
TLSe No No
wolfSSL No No
Implementation TPM support Hardware token support Objects identified via

Code dependencies

Implementation Dependencies Optional
dependencies
Botan C++11 sqlite, zlib (compression), bzip2 (compression), liblzma (compression)
GnuTLS libc
nettle
gmp		 zlib (compression)
p11-kit (PKCS #11)
trousers (TPM)
JSSE Java
MatrixSSL none zlib (compression)
MatrixSSL-open libc or newlib
mbed TLS libc libpkcs11-helper (PKCS #11)
zlib (compression)
NSS libc
libnspr4
libsoftokn3
libplc4
libplds4		 zlib (compression)
OpenSSL libc zlib (compression)
SharkSSL None
TLSe none tomcrypt
wolfSSL None libc, zlib (compression)
Implementation Dependencies Optional
dependencies

Development environment

Implementation Namespace Build tools API manual Crypto back-end OpenSSL compatibility Layer[clarify]
Botan Botan::TLS Makefile Sphinx Included (monolithic) No
cryptlib crypt* makefile, MSVC project workspaces Programmers reference manual (PDF), architecture design manual (PDF) Included (monolithic) No
GnuTLS gnutls_* Autoconf, automake, libtool Manual and API reference (HTML, PDF) External, libnettle Yes (limited)
JSSE javax.net.ssl Makefile API Reference (HTML) +

Java SE 8

 Java Cryptography Architecture,
Java Cryptography Extension		 No
MatrixSSL matrixSsl_*

ps*

 Makefile, MSVC project workspaces, Xcode projects for OS X and iOS API Reference (PDF), Integration Guide Included (pluggable) Yes (Subset: SSL_read, SSL_write, etc.)
mbed TLS ssl_*

sha1_*
md5_*
x509parse_*
...

 Makefile, CMake, MSVC project workspaces API Reference + High Level and Module Level Documentation (HTML) Included (monolithic) No
NSS CERT_*

SEC_*
SECKEY_*
NSS_*
PK11_*
SSL_*
...

 Makefile Manual (HTML) Included, PKCS#11 based[190] Yes (separate package called nss_compat_ossl[191])
OpenSSL SSL_*

SHA1_*
MD5_*
EVP_*
...

 Makefile Man pages Included (monolithic) N/A
SharkSSL SharkSsl* Makefile (online) HTML Manual and API Reference Included (monolithic) No
TLSe tls_*

SSL_*

 Single C file Work in progress Included or tomcrypt Yes (Subset: SSL_read, SSL_write, etc.)
wolfSSL CyaSSL_*

SSL_*

 Autoconf, automake, libtool, MSVC project workspaces, XCode projects, CodeWarrior projects, MPLAB X projects, Keil, IAR, Clang, GCC Manual and API Reference (HTML, PDF) Included (monolithic) Yes (about 10% of API)
Implementation Namespace Build tools API manual Crypto back-end OpenSSL compatibility layer

Portability concerns

Implementation Platform requirements Network requirements Thread safety Random seed Able to cross-compile No OS (bare metal) Supported operating systems
Botan C++11 None Thread-safe Platform-dependent Yes Most Windows and POSIX systems
cryptlib C89 POSIX send() and recv(). API to supply your own replacement Thread-safe Platform-dependent, including hardware sources Yes Yes AMX, BeOS, ChorusOS, DOS, eCos, FreeRTOS/OpenRTOS, uItron, MVS, OS/2, Palm OS, QNX Neutrino, RTEMS, Tandem NonStop, ThreadX, uC/OS II, Unix (AIX, FreeBSD, HPUX, Linux, OS X, Solaris, etc.), VDK, VM/CMS, VxWorks, Win16, Win32, Win64, WinCE/PocketPC/etc, XMK
GnuTLS C89 POSIX send() and recv(). API to supply your own replacement. Thread-safe, needs custom mutex hooks if neither POSIX nor Windows threads are available. Platform dependent Yes No Generally any POSIX platforms or Windows, commonly tested platforms include GNU/Linux, Win32/64, OS X, Solaris, OpenWRT, FreeBSD, NetBSD, OpenBSD.
JSSE Java Java SE network components Thread-safe Depends on java.security.SecureRandom Yes Java based, platform-independent
MatrixSSL C89 None Thread-safe Platform dependent Yes Yes All
mbed TLS C89 POSIX read() and write(). API to supply your own replacement. Threading layer available (POSIX or own hooks) Random seed set through entropy pool Yes Yes Known to work on: Win32/64, Linux, OS X, Solaris, FreeBSD, NetBSD, OpenBSD, OpenWRT, iPhone (iOS), Xbox, Android, SeggerOS
NSS C89, NSPR[192] NSPR[192] PR_Send() and PR_Recv(). API to supply your own replacement. Thread-safe Platform dependent[193] Yes (but cumbersome) No AIX, Android, FreeBSD, NetBSD, OpenBSD, BeOS, HP-UX, IRIX, Linux, OS X, OS/2, Solaris, OpenVMS, Amiga DE, Windows, WinCE, Sony PlayStation
OpenSSL C89?  ? Needs mutex callbacks Set through native API Yes No Unix, DOS (with djgpp), Windows, OpenVMS, MacOS, NetWare, eCos
SharkSSL C89 None: Transport agnostic API Thread-safe: multiple ports Random seed set through entropy pool and/or HW Yes Yes INTEGRITY, MQX, SMX, ThreadX, VxWorks, SeggerOS, OSE, Android, Win 32/64, Linux 32/64, uCLinux, OS X, OpenBSD, DD-WRT, OpenWrt
TLSe C89 None Thread-safe Platform-independent Yes Linux, BSD, Windows, OS X
wolfSSL C89 POSIX send() and recv(). API to supply your own replacement. Thread-safe, needs mutex hooks if PThreads or WinThreads not available, can be turned off Random seed set through wolfCrypt Yes Yes Win32/64, Linux, OS X, Solaris, ThreadX, VxWorks, FreeBSD, NetBSD, OpenBSD, embedded Linux, Haiku, OpenWRT, iPhone (iOS), Android, Nintendo Wii and Gamecube through DevKitPro, QNX, MontaVista, OpenCL, NonStop, TRON/ITRON/µITRON, Micrium's µC OS, FreeRTOS, SafeRTOS, Freescale MQX, Nucleus, TinyOS, HP/UX, Keil RTX, TI-RTOS
Implementation Platform requirements Network requirements Thread safety Random seed Able to cross-compile No OS (bare metal) Supported operating systems

See also

  • SCTP — with DTLS support
  • DCCP — with DTLS support
  • SRTP — with DTLS support (DTLS-SRTP) and Secure Real-Time Transport Control Protocol (SRTCP)

References

  1. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  2. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  3. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  4. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  5. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  6. ↑ 6.0 6.1 Lua error in package.lua at line 80: module 'strict' not found.
  7. ↑ 7.0 7.1 Lua error in package.lua at line 80: module 'strict' not found.
  8. ↑ The features listed are for the closed source version
  9. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  10. ↑ 10.0 10.1 10.2 10.3 Lua error in package.lua at line 80: module 'strict' not found.
  11. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  12. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  13. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  14. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  15. ↑ 15.0 15.1 Lua error in package.lua at line 80: module 'strict' not found.
  16. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  17. ↑ 17.0 17.1 Lua error in package.lua at line 80: module 'strict' not found.
  18. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  19. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  20. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  21. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  22. ↑ RFC6176: Prohibiting Secure Sockets Layer (SSL) Version 2.0
  23. ↑ "CBC-Padding: Security Flaws in SSL, IPsec, WTLS,...", Serge Vaudenay, 2001
  24. ↑ RFC7366: Encrypt-then-MAC for Transport Layer Security (TLS) and Datagram Transport Layer Security
  25. ↑ Rizzo/Duong BEAST Countermeasures
  26. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  27. ↑ TLSv1.2's Major Differences from TLSv1.1
  28. ↑ 28.0 28.1 RFC 6347
  29. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  30. ↑ The SSL Protocol <draft-hickman-netscape-ssl-00.txt>
  31. ↑ RFC 6101
  32. ↑ RFC 2246
  33. ↑ RFC 4346
  34. ↑ 34.0 34.1 34.2 34.3 34.4 34.5 RFC 5246
  35. ↑ draft-ietf-tls-tls13-11 - The Transport Layer Security (TLS) Protocol Version 1.3
  36. ↑ draft-ietf-tls-tls13-latest
  37. ↑ RFC 4347
  38. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  39. ↑ 39.0 39.1 39.2 39.3 39.4 39.5 Lua error in package.lua at line 80: module 'strict' not found.
  40. ↑ 40.00 40.01 40.02 40.03 40.04 40.05 40.06 40.07 40.08 40.09 40.10 40.11 40.12 Lua error in package.lua at line 80: module 'strict' not found.
  41. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  42. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  43. ↑ 43.0 43.1 43.2 43.3 43.4 Lua error in package.lua at line 80: module 'strict' not found.
  44. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  45. ↑ 45.0 45.1 Lua error in package.lua at line 80: module 'strict' not found.
  46. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  47. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  48. ↑ 48.0 48.1 48.2 Lua error in package.lua at line 80: module 'strict' not found.
  49. ↑ 49.0 49.1 Lua error in package.lua at line 80: module 'strict' not found.
  50. ↑ 50.0 50.1 50.2 50.3 50.4 50.5 Lua error in package.lua at line 80: module 'strict' not found.
  51. ↑ 51.00 51.01 51.02 51.03 51.04 51.05 51.06 51.07 51.08 51.09 51.10 51.11 51.12 51.13 51.14 51.15 51.16 51.17 51.18 51.19 Lua error in package.lua at line 80: module 'strict' not found.
  52. ↑ TLS cipher suites in Microsoft Windows XP and 2003
  53. ↑ SChannel Cipher Suites in Microsoft Windows Vista
  54. ↑ 54.0 54.1 54.2 TLS Cipher Suites in SChannel for Windows 7, 2008R2, 8, 2012
  55. ↑ 55.0 55.1 Lua error in package.lua at line 80: module 'strict' not found.
  56. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  57. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  58. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  59. ↑ https://dev.ssllabs.com/ssltest/clients.html
  60. ↑ 60.0 60.1 http://docs.oracle.com/javase/8/docs/technotes/guides/security/enhancements-8.html
  61. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  62. ↑ http://technet.microsoft.com/en-us/library/dd566200(v=ws.10).aspx
  63. ↑ "Secure or Compliant, Pick One" Steve Marquess blog
  64. ↑ http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm
  65. ↑ "Is botan FIPS 140 certified?" Frequently Asked Questions — Botan
  66. ↑ "What about FIPS 140 certification?" cryptlib FAQ
  67. ↑ "As such we are not actively pursuing this kind of certification." GnuTLS 3.3.10 B.5 Certification
  68. ↑ Matrix SSL Toolkit
  69. ↑ Is PolarSSL FIPS certified?
  70. ↑ FIPS Validation - MozillaWiki
  71. ↑ OpenSSL and FIPS 140-2
  72. ↑ Validated 140-1 and 140-2 Cryptographic Modules
  73. ↑ Microsoft FIPS 140 Validated Cryptographic Modules
  74. ↑ wolfSSL - wolfCrypt FIPS 140-2 Validation
  75. ↑ 75.00 75.01 75.02 75.03 75.04 75.05 75.06 75.07 75.08 75.09 75.10 75.11 75.12 75.13 75.14 75.15 75.16 75.17 75.18 75.19 75.20 75.21 75.22 75.23 75.24 75.25 75.26 75.27 75.28 75.29 75.30 75.31 RFC 4492
  76. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  77. ↑ 78.0 78.1 78.2 78.3 Extensions to support JSSE in SChannel might be available.[citation needed]
  78. ↑ 79.0 79.1 79.2 79.3 79.4 Lua error in package.lua at line 80: module 'strict' not found.
  79. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  80. ↑ 81.0 81.1 81.2 81.3 Lua error in package.lua at line 80: module 'strict' not found.
  81. ↑ 82.0 82.1 82.2 82.3 Lua error in package.lua at line 80: module 'strict' not found.
  82. ↑ 83.0 83.1 83.2 83.3 Lua error in package.lua at line 80: module 'strict' not found.
  83. ↑ 84.0 84.1 84.2 84.3 openssl/engines/ccgost/README.gost
  84. ↑ 85.00 85.01 85.02 85.03 85.04 85.05 85.06 85.07 85.08 85.09 85.10 85.11 85.12 85.13 Extensions to support GOST in SChannel might be available.[citation needed]
  85. ↑ 86.0 86.1 86.2 Lua error in package.lua at line 80: module 'strict' not found.
  86. ↑ 87.0 87.1 87.2 87.3 Lua error in package.lua at line 80: module 'strict' not found.
  87. ↑ 88.0 88.1 Update adds new TLS cipher suites and changes cipher suite priorities in Windows 8.1 and Windows Server 2012 R2
  88. ↑ 89.0 89.1 89.2 RFC 5054
  89. ↑ 90.0 90.1 90.2 RFC 4279
  90. ↑ RFC 5489
  91. ↑ RFC 2712
  92. ↑ 93.0 93.1 93.2 Lua error in package.lua at line 80: module 'strict' not found.
  93. ↑ 94.0 94.1 94.2 Lua error in package.lua at line 80: module 'strict' not found.
  94. ↑ 95.0 95.1 95.2 95.3 Lua error in package.lua at line 80: module 'strict' not found.
  95. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  96. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  97. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  98. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  99. ↑ RFC 5280
  100. ↑ RFC 3280
  101. ↑ RFC 2560
  102. ↑ RFC 6698, RFC 7218
  103. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  104. ↑ 105.0 105.1 Lua error in package.lua at line 80: module 'strict' not found.
  105. ↑ RFC 5288, RFC 5289
  106. ↑ RFC 6655, RFC 7251
  107. ↑ RFC 6367
  108. ↑ RFC 5932, RFC 6367
  109. ↑ 110.0 110.1 RFC 6209
  110. ↑ RFC 4162
  111. ↑ draft-ietf-tls-chacha20-poly1305 The ChaCha20-Poly1305 AEAD Cipher for Transport Layer Security
  112. ↑ 113.0 113.1 Lua error in package.lua at line 80: module 'strict' not found.
  113. ↑ 114.0 114.1 Lua error in package.lua at line 80: module 'strict' not found.
  114. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  115. ↑ PolarSSL 1.3.8 release notes
  116. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  117. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  118. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  119. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  120. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  121. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  122. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  123. ↑ Changes between 1.0.2g and 1.1.0
  124. ↑ Implemented in 1.1.0 Alpha[124]
  125. ↑ Hofix 984963: TLS AES cipher suites for Microsoft Windows 2003
  126. ↑ 127.0 127.1 127.2 https://dev.ssllabs.com/ssltest/viewClient.html?name=IE&version=11&platform=Win%2010%20Preview
  127. ↑ RFC 5469
  128. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  129. ↑ http://docs.oracle.com/javase/8/docs/technotes/guides/security/SunProviders.html
  130. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  131. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  132. ↑ Microsoft security advisory: Update for disabling RC4
  133. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  134. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  135. ↑ 136.0 136.1 Lua error in package.lua at line 80: module 'strict' not found.
  136. ↑ 137.0 137.1 Negotiation of arbitrary curves has been shown to be insecure for certain curve sizes Lua error in package.lua at line 80: module 'strict' not found.
  137. ↑ 138.0 138.1 138.2 RFC 7027
  138. ↑ 139.0 139.1 Curve25519 for ephemeral key exchange in Transport Layer Security (TLS): draft-ietf-tls-curve25519
  139. ↑ 140.0 140.1 140.2 140.3 140.4 140.5 140.6 140.7 140.8 Additional Elliptic Curves for Transport Layer Security (TLS) Key Agreement: draft-josefsson-tls-additional-curves
  140. ↑ 141.0 141.1 141.2 Lua error in package.lua at line 80: module 'strict' not found.
  141. ↑ 142.0 142.1 142.2 Lua error in package.lua at line 80: module 'strict' not found.
  142. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  143. ↑ 144.0 144.1 144.2 Lua error in package.lua at line 80: module 'strict' not found.
  144. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  145. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  146. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  147. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  148. ↑ RFC 3749
  149. ↑ RFC 5746
  150. ↑ 151.0 151.1 151.2 151.3 RFC 6066
  151. ↑ RFC 7301
  152. ↑ RFC 6091
  153. ↑ RFC 4680
  154. ↑ RFC 5077
  155. ↑ RFC 5705
  156. ↑ RFC 7366
  157. ↑ RFC 7507
  158. ↑ RFC 7627
  159. ↑ RFC 7685
  160. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  161. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  162. ↑ Present, but disabled by default due to lack of use by any implementation.
  163. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  164. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  165. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  166. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  167. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  168. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  169. ↑ 170.0 170.1 170.2 Lua error in package.lua at line 80: module 'strict' not found.
  170. ↑ 171.0 171.1 Lua error in package.lua at line 80: module 'strict' not found.
  171. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  172. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  173. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  174. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  175. ↑ http://www.openssl.org/news/secadv_20141015.txt
  176. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  177. ↑ 178.0 178.1 Lua error in package.lua at line 80: module 'strict' not found.
  178. ↑ http://stackoverflow.com/questions/14259671/java-ssl-provider-with-aes-ni-support
  179. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  180. ↑ Normally NSS's libssl performs all operations via the PKCS#11 interface, either to hardware or software tokens
  181. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  182. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  183. ↑ http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ddacb8f27ba4c8a8d51c306c150e1a8703b008f2
  184. ↑ http://www.opensource.apple.com/source/Security/Security-55179.13/sec/Security/SecECKey.c
  185. ↑ http://km.support.apple.com/library/APPLE/APPLECARE_ALLGEOS/HT5396/Crypto_Officer_Role_Guide_for_FIPS_140-2_Compliance_OS_X_Mountain_Lion_v10.8.pdf
  186. ↑ Sirius and wolfSSL on OCTEON https://www.sirius-networks.com/en/products/sirius-wolfssl-on-octeon.php?item=1
  187. ↑ Lua error in package.lua at line 80: module 'strict' not found.
  188. ↑ RFC 7512
  189. ↑ On the fly replaceable/augmentable.
  190. ↑ http://fedoraproject.org/wiki/Nss_compat_ossl
  191. ↑ 192.0 192.1 Netscape Portable Runtime (NSPR)
  192. ↑ For Unix/Linux it uses /dev/urandom if available, for Windows it uses CAPI. For other platforms it gets data from clock, and tries to open system files. NSS has a set of platform dependent functions it uses to determine randomness.
Retrieved from "https://infogalactic.com/w/index.php?title=Comparison_of_TLS_implementations&oldid=722590010"