SSL ECC 256 bit vs RSA 2048 bit SSL

Edit: split off posts to new thread

had to modify my curl command as sslspdy.com used ECDHE_ECDSA so needed to pass the appropriate cipher too

---

Code:

curl -1IsS https://sslspdy.com
curl: (35) Cannot communicate securely with peer: no common encryption algorithm(s).

Code:

curl -1IsS --ciphers ecdhe_ecdsa_aes_128_sha https://sslspdy.com
HTTP/1.1 200 OK
Server: nginx centminmod
Content-Type: text/html; charset=utf-8
Connection: keep-alive
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000
Date: Tue, 10 Feb 1970 22:32:54 GMT
X-Page-Speed: 1.8.31.4-4009
Cache-Control: max-age=0, no-cache

verbose check with curl 7.37

Code:

curl -16IsS https://sslspdy.com -v
* Rebuilt URL to: https://sslspdy.com/
* Hostname was NOT found in DNS cache
*   Trying 2604:180:1::fd2c:e402...
* Connected to sslspdy.com (2604:180:1::fd2c:e402) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Server key exchange (12):
* SSLv3, TLS handshake, Server finished (14):
* SSLv3, TLS handshake, Client key exchange (16):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-ECDSA-AES128-GCM-SHA256
* Server certificate:
*        subject: OU=Domain Control Validated; OU=Free SSL; CN=sslspdy.com
*        start date: 2014-08-02 00:00:00 GMT
*        expire date: 2014-10-31 23:59:59 GMT
*        subjectAltName: sslspdy.com matched
*        issuer: C=GB; ST=Greater Manchester; L=Salford; O=COMODO CA Limited; CN=COMODO ECC Domain Validation Secure Server CA
*        SSL certificate verify ok.
> HEAD / HTTP/1.1
> User-Agent: curl/7.37.1
> Host: sslspdy.com
> Accept: */*
>
< HTTP/1.1 200 OK
HTTP/1.1 200 OK
* Server nginx centminmod is not blacklisted
< Server: nginx centminmod
Server: nginx centminmod
< Content-Type: text/html; charset=utf-8
Content-Type: text/html; charset=utf-8
< Connection: keep-alive
Connection: keep-alive
< Vary: Accept-Encoding
Vary: Accept-Encoding
< Strict-Transport-Security: max-age=31536000
Strict-Transport-Security: max-age=31536000
< Date: Wed, 11 Feb 1970 02:43:30 GMT
Date: Wed, 11 Feb 1970 02:43:30 GMT
< X-Page-Speed: 1.8.31.4-4009
X-Page-Speed: 1.8.31.4-4009
< Cache-Control: max-age=0, no-cache
Cache-Control: max-age=0, no-cache

<
* Connection #0 to host sslspdy.com left intact

 

you sure A (Relatively Easy To Understand) Primer on Elliptic Curve Cryptography | CloudFlare Blog

 

@Floren, I split off these posts from the other thread and moved to Email, Domains and SSL forums

For background info see Nginx - Centmin Mod Nginx VHOST SPDY SSL Generator testing | Centmin Mod Community

I chose to continue using RSA 2048 bit and thus ECDHE_RSA for key exchange mechanism for centminmod.com wildcard SSL Certificate for better compatibility as it's clear some tools like curl would have issues still and I have no control of 3rd party monitoring and whether it supports ECDSA yet. I plan to use dual SSL wildcard certificates though, so with centminmod.com I am going to get a 2nd wildcard SSL Certificate but with ECC 256 bit SSL and ECDHE_ECDSA key exchange so I can test either RSA 2048 bit or ECC 256 bit on particular subdomains of *.centminmod.com

Basically ECDSA isn't your cipher preference but rather your key exchange mechanism preference you choose at the time you generate your private key and CSR Code. Traditionally, folks have been generating private key and CSR Code via RSA 1024 bit and now RSA 2048 bit - so with your cipher preferences you'd see ECDHE_RSA as the key exchange mechanism. You can only change to using ECC 256 bit SSL if your SSL provider's SSL certificates support ECC and if at time of generating private key and CSR Code, you use ECC 256 bit to generate your private key and CSR Code. Then if your SSL provider supports ECC certificates (see CA Security Council | Benefits of Elliptic Curve Cryptography) they will take your ECC 256 bit generated CSR Code and generate a ECC 256 bit SSL certificate as opposed to a RSA 2048 bit SSL certificate.

So essentially, if you want to switch from RSA 2048 bit SSL certificate and key exchange mechanism, you would need a brand new SSL certificate which is a ECC 256 bit SSL certificate from a supported provider such as Comodo or Symantec and provide them with a CSR Code which is generated (along with private key) using ECC 256 bit rather than RSA 2048 bit.

For ECC 256 bit SSL certificate from Comodo, they will provide a ECC 256 bit SSL certificate along with their intermediate and roots which are labelled as ECC on some

See example of sslspdy.com which is using ECC 256 bit SSL and ECDHE_ECDSA created with ECC 256 bit key algorithm and sha256 signature algorithm

• Root CA Certificate - AddTrustExternalCARoot.crt
• Intermediate CA Certificate - COMODOECCAddTrustCA.crt
• Intermediate CA Certificate - COMODOECCDomainValidationSecureServerCA.crt
• Your SSL Certificate - sslspdy_com.crt

Now see community.centminmod.com which is using RSA 2048 bit SSL and ECDHE_RSA created with RSA 2048 bit key algorithm and sha256 signature algorithm

• Root CA Certificate - AddTrustExternalCARoot.crt
• Intermediate CA Certificate - COMODORSAAddTrustCA.crt
• Intermediate CA Certificate - COMODORSADomainValidationSecureServerCA.crt
• Your GGSSL Wildcard SSL - STAR_centminmod_com.crt

 

More ECC/ECDSA info CA Security Council | New Directions for Elliptic Curve Cryptography in Internet Protocols

 

interesting benchmarks and article info on ECDSA and RSA based TLS connections RSA and ECDSA performance | securitypitfalls