What Defines Cipher Grades?

Question

I've been searching for what exactly defines different encryption "cipher grades" - such as those used in SSL and TLS, but haven't been able to find a specific resource that draws the line between them.

What defines LOW, MEDIUM, and STRONG cipher grades?

Answer 1

There are many factors that contribute to the security level (grade is rarely used for this term) of ciphersuites. Many algorithms are involved, e.g. different algorithms for key exchange (RSA or Diffie-Hellman), other algorithms for the confidentiality part (AES, RC4 etc) and even more for message authentication. There is no uniform classification that I know of except for the ciphersuites in the SuiteB profile. In GnuTLS we have also a classification based on the long term key sizes.

Answer 2

I believe this is vendor-specific. Which SSL vendor are you using?

• F5 defines cipher grades for its load balancers on this chart (dead link as of November 2014).

• Apache has "cipher suites" defined in its documentation for mod_ssl (source).

• Stunnel doesn't have cipher grades, but lets you supply a list of allowed ciphers (source).

They're all somewhat different, although people generally agree that DES is weak and AES-256 is strong.