This post will walk you through recommending an algorithm name for Artemis Financial, a hypothetical agency, to secure their API. I will start by explaining some terms to help make sense of this post.
Terminology
Ciphers
Ciphers are algorithms for encryption, decryption, hashing, or digital signatures. The goal of a cipher is to encrypt (encipher) a message to prevent eavesdropping. Ciphers and algorithms are used interchangeably in this context. Ciphers are also packaged into cipher suites.
Cipher suite
“A cipher suite is a set of algorithms that help secure a network connection. Suites typically use Transport Layer Security (TLS) or its now-deprecated predecessor Secure Socket Layer (SSL)” (Wikipedia, 2022).
TLS
TLS is a cryptographic protocol for providing secure communication over a computer network. TLS replaced the formerly used cryptographic protocol Secure Sockets Layer (SSL). Sometimes, TLS and SSL are used interchangeably to mean the same thing. TLS secures emails, VOIP, instant messaging, and the well-known Hypertext Transfer Protocol Secure (HTTPS) connection.
Plaintext
A plaintext is unencrypted data, hence the name.
Ciphertext
A ciphertext is enciphered data or encrypted data that is unreadable before decryption.
TLS handshake
TLS handshake is when the server and client agree on a specific cipher suite to use for securing a connection and transferring data over the internet. The browser sends the server a list of cipher suites it supports, and the server determines which one it will use.
Encryption types are divided into two categories: Symmetric and Asymmetric encryptions.
Symmetric encryption
Symmetric encryption means one key is capable of encrypting and decrypting a message.
Asymmetric encryption
Asymmetric encryption means that one key encrypts a message, and the other decrypts the message.
Requirements
Artemis Financial is a financial consulting company that develops personalized financial plans for its customers. Their requirements are to use the most current and effective software security to secure their API connections.
To secure Artemis Financial’s API, we will choose an algorithm name based on TLS 1.3 and the algorithm names provided by the client.
TLS 1.3 cipher suites we will consider
- TLS_AES_128_GCM_SHA256
- TLS_AES_256_GCM_SHA384
- TLS_AES_128_CCM_SHA256
- TLS_AES_128_CCM_8_SHA256
- TLS_CHACHA2_POLY135_SHA256
It is worth noting that the list of recommended cipher suites dropped from 37 in TLS 1.2 to only 5 in TLS 1.3, which gives us fewer options to choose from.
Recommended algorithm names extracted from oracle.com
From oracle.com, “The Java SE Security API requires and uses a set of standard names for algorithms, certificate and keystore types. You can find a list of standard algorithm names in this document.”
- AES (supported in TLS 1.3)
- AESWrap
- ARCFOUR
- Blowfish
- DES (obsolete)
- DESede
- DESedeWrap
- ECIES
- PBEWith<digest>And<encryption> PBEWith<prf>And<encryption>
- RC2, RC4, and RC5 (not supported)
- RSA (key exchanges not supported)
Next, we need to drop all the algorithm names not supported in TLS 1.3.
Considerations from Iron-Clad Java:
- “Try to avoid suites using RC4, DES, and 3DES” (Manico & Detlefsen, 2014).
- “Stick to bulk ciphers with key sizes of 128 bits or larger” (Manico & Detlefsen, 2014).
- “Protect your communications by selecting cipher suites that support forward secrecy (ECDHE or DHE)” (Manico & Detlefsen, 2014).
The winner
The list of algorithm names simply becomes AES.
AES is the recommended algorithm name for Artemis Financial, namely the TLS_AES_128_GCM_SHA256 cipher suite.
Note: A client will need to support a cipher suite before communicating with the API.
Rational
Advanced Encryption Standard (AES) is a symmetric algorithm (cipher) that uses three key lengths (128, 192, and 256 bits) to encrypt and decrypt 128 bits of plaintext blocks. AES is implementable in C and Java, widely used, well-vetted, and secure.
According to Nicolas Poggi:
AES is one of the most common symmetric encryption algorithms used today, developed as a replacement to the outdated DES (Data Encryption Standard), cracked by security researchers back in 25. This new algorithm sought to solve its predecessor’s main weakness, a short encryption key length vulnerable to brute force (2021).
AES was developed as a replacement for DES and is considered secure to date. AES takes plaintext in blocks of 128-bits and encrypts them using 128, 192, and 256 key size bits. The larger keys help protect against brute force attacks and can scale up in the future.
Cryptographic hash functions
The cryptographic hash functions used with AES in TLS 1.3 are SHA-256
and SHA384. Typically, hash functions have the following properties:
- Collision free, input hashes should not map to the same output hash
- Infeasible to guess the input hash using the output hash
- Infeasible to produce a predefined output from an input
Read my post on recommending a hash function.
References
Manico, J., Detlefsen, A. (2014). Protecting Sensitive Data. https://learning.oreilly.com/library/view/iron-clad-java/97871835886/ch6.html#ch6lev2sec4
National Security Agency. (2021). Eliminating obsolete Transport Layer Security (TLS) protocol configurations. https://media.defense.gov/2021/Jan/5/225614/-1/-1//ELIMINATING_OBSOLETE_TLS_UOO197443-2.PDF
NIST. (2022). Guidelines for the selection, configuration, and use of Transport Layer Security (TLS) implementations: NIST SP 8-52 Rev. 2. https://csrc.nist.gov/News/219/nist-publishes-sp-8-52-revision-2
Nohe. P. (2019). Cipher suites: ciphers, algorithms, and negotiating security settings. https://www.thesslstore.com/blog/cipher-suites-algorithms-security-settings/
Poggi, N. (2021). Types of encryption: Symmetric or asymmetric? RSA or AES?. https://preyproject.com/blog/en/types-of-encryption-symmetric-or-asymmetric-rsa-or-aes/
Wikipedia. (2022). Cipher suite. Wikipedia. https://en.wikipedia.org/wiki/Cipher_suite
Wikipedia. (2022). Transport layer security. Wikipedia. https://en.wikipedia.org/wiki/Transport_Layer_Security