Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

Have set up an SSL certificate for a new site, and in checking with the browser, the SSL states it's encrypted with 128bit encryption. I have tried with the latest versions of Chrome, IE9 and FF, all with the same result.

The certificate is from trustico - RapidSSL - which states up to 256bit is supported. This makes me think that it supports 256bit if the browser supports it.

The site is being hosted on IIS 6.

Has anybody run into this?

share|improve this question

migrated from stackoverflow.com Feb 1 '12 at 3:36

This question came from our site for professional and enthusiast programmers.

2  
If you want to try, you could force your browser to try 256-bit cipher suites. In FF, type about:config in the location bar, filter security.ssl3 and turn off the ones with 128 or under in their names. (Make sure you don't enable weaker ones. To revert to the default, look for the values in bold/with status "user set".) Not sure if II6 would support them, though (it may depend on how it's configured). As Borealid said, AES-128 is considered good enough nowadays (or AES-256 isn't considered much stronger in fact). It's not just about the key size, the algorithm may matter too. –  Bruno Jan 31 '12 at 10:39
add comment

2 Answers 2

up vote 5 down vote accepted

First off, 128-bit AES is very good. The prevailing opinion is that it is secure for the future close enough to care about.

Setting that aside, the reason you're getting 128-bit encryption is because that was what was negotiated. The certificate has little to do with it; the SSL cert is an RSA keypair, and there's no way that's only 128 bits. It's more likely you're using a 2048-bit public-private pair and you just negotiated a 128-bit TLS session key.

Take a look at the server settings - IIS 6 is very dated at this point.

share|improve this answer
    
Thanks for the info - didn't really consider an IIS issue as such. Will check it out. –  Franky Jan 31 '12 at 6:35
    
@Franky, it's the cipher suites, not the certificate that determine the symmetric key size. (As discussed in comments in this closed question, the days of SGC certs are over, or should be.) –  Bruno Jan 31 '12 at 10:36
add comment

Encrypting something over 128bit may be "military encryption" and it's illegal by civilians. Same things about sending messages or file encryption by PGP.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.