// Cipher Suite Metadata and Security Properties Database (RFC 5246 / RFC 8446)
///|
pub struct CipherDetails {
id : UInt16
name : String
kex : String
enc : String
mac : String
strength : Int
is_recommended : Bool
} derive(Debug, Eq)
///|
let cipher_details_db : Array[CipherDetails] = [
// TLS 1.3 AEAD Ciphers
{
id: 0x1301,
name: "TLS_AES_128_GCM_SHA256",
kex: "ECDHE/DHE",
enc: "AES-GCM-128",
mac: "AEAD",
strength: 128,
is_recommended: true,
},
{
id: 0x1302,
name: "TLS_AES_256_GCM_SHA384",
kex: "ECDHE/DHE",
enc: "AES-GCM-256",
mac: "AEAD",
strength: 256,
is_recommended: true,
},
{
id: 0x1303,
name: "TLS_CHACHA20_POLY1305_SHA256",
kex: "ECDHE/DHE",
enc: "CHACHA20-POLY1305",
mac: "AEAD",
strength: 256,
is_recommended: true,
},
{
id: 0x1304,
name: "TLS_AES_128_CCM_SHA256",
kex: "ECDHE/DHE",
enc: "AES-CCM-128",
mac: "AEAD",
strength: 128,
is_recommended: true,
},
{
id: 0x1305,
name: "TLS_AES_128_CCM_8_SHA256",
kex: "ECDHE/DHE",
enc: "AES-CCM-8-128",
mac: "AEAD",
strength: 128,
is_recommended: true,
},
// TLS 1.2 ECDHE ECDSA AEAD Ciphers
{
id: 0xc02b,
name: "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
kex: "ECDHE",
enc: "AES-GCM-128",
mac: "AEAD",
strength: 128,
is_recommended: true,
},
{
id: 0xc02c,
name: "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
kex: "ECDHE",
enc: "AES-GCM-256",
mac: "AEAD",
strength: 256,
is_recommended: true,
},
// TLS 1.2 ECDHE RSA AEAD Ciphers
{
id: 0xc02f,
name: "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
kex: "ECDHE",
enc: "AES-GCM-128",
mac: "AEAD",
strength: 128,
is_recommended: true,
},
{
id: 0xc030,
name: "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
kex: "ECDHE",
enc: "AES-GCM-256",
mac: "AEAD",
strength: 256,
is_recommended: true,
},
// TLS 1.2 DHE RSA AEAD Ciphers
{
id: 0x0033,
name: "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256",
kex: "DHE",
enc: "AES-GCM-128",
mac: "AEAD",
strength: 128,
is_recommended: true,
},
{
id: 0x0039,
name: "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384",
kex: "DHE",
enc: "AES-GCM-256",
mac: "AEAD",
strength: 256,
is_recommended: true,
},
// TLS 1.2 ECDHE CHACHA20-POLY1305 Ciphers
{
id: 0xcca9,
name: "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
kex: "ECDHE",
enc: "CHACHA20-POLY1305",
mac: "AEAD",
strength: 256,
is_recommended: true,
},
{
id: 0xcca8,
name: "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
kex: "ECDHE",
enc: "CHACHA20-POLY1305",
mac: "AEAD",
strength: 256,
is_recommended: true,
},
// TLS 1.2 ECDHE CBC Ciphers (Legacy but commonly deployed)
{
id: 0xc009,
name: "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
kex: "ECDHE",
enc: "AES-CBC-128",
mac: "HMAC-SHA1",
strength: 128,
is_recommended: false,
},
{
id: 0xc00a,
name: "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
kex: "ECDHE",
enc: "AES-CBC-256",
mac: "HMAC-SHA1",
strength: 256,
is_recommended: false,
},
{
id: 0xc023,
name: "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
kex: "ECDHE",
enc: "AES-CBC-128",
mac: "HMAC-SHA256",
strength: 128,
is_recommended: false,
},
{
id: 0xc024,
name: "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
kex: "ECDHE",
enc: "AES-CBC-256",
mac: "HMAC-SHA384",
strength: 256,
is_recommended: false,
},
{
id: 0xc013,
name: "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
kex: "ECDHE",
enc: "AES-CBC-128",
mac: "HMAC-SHA1",
strength: 128,
is_recommended: false,
},
{
id: 0xc014,
name: "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
kex: "ECDHE",
enc: "AES-CBC-256",
mac: "HMAC-SHA1",
strength: 256,
is_recommended: false,
},
{
id: 0xc027,
name: "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
kex: "ECDHE",
enc: "AES-CBC-128",
mac: "HMAC-SHA256",
strength: 128,
is_recommended: false,
},
{
id: 0xc028,
name: "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
kex: "ECDHE",
enc: "AES-CBC-256",
mac: "HMAC-SHA384",
strength: 256,
is_recommended: false,
},
// TLS 1.2 DHE CBC Ciphers
{
id: 0x002f,
name: "TLS_DHE_RSA_WITH_AES_128_CBC_SHA",
kex: "DHE",
enc: "AES-CBC-128",
mac: "HMAC-SHA1",
strength: 128,
is_recommended: false,
},
{
id: 0x0035,
name: "TLS_DHE_RSA_WITH_AES_256_CBC_SHA",
kex: "DHE",
enc: "AES-CBC-256",
mac: "HMAC-SHA1",
strength: 256,
is_recommended: false,
},
{
id: 0x0067,
name: "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256",
kex: "DHE",
enc: "AES-CBC-128",
mac: "HMAC-SHA256",
strength: 128,
is_recommended: false,
},
{
id: 0x006b,
name: "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256",
kex: "DHE",
enc: "AES-CBC-256",
mac: "HMAC-SHA256",
strength: 256,
is_recommended: false,
},
// Plain RSA CBC Ciphers (No Forward Secrecy - Strongly Discouraged)
{
id: 0x000a,
name: "TLS_RSA_WITH_3DES_EDE_CBC_SHA",
kex: "RSA",
enc: "3DES-EDE-CBC",
mac: "HMAC-SHA1",
strength: 112,
is_recommended: false,
},
{
id: 0x002f,
name: "TLS_RSA_WITH_AES_128_CBC_SHA",
kex: "RSA",
enc: "AES-CBC-128",
mac: "HMAC-SHA1",
strength: 128,
is_recommended: false,
},
{
id: 0x0035,
name: "TLS_RSA_WITH_AES_256_CBC_SHA",
kex: "RSA",
enc: "AES-CBC-256",
mac: "HMAC-SHA1",
strength: 256,
is_recommended: false,
},
{
id: 0x003c,
name: "TLS_RSA_WITH_AES_128_CBC_SHA256",
kex: "RSA",
enc: "AES-CBC-128",
mac: "HMAC-SHA256",
strength: 128,
is_recommended: false,
},
{
id: 0x003d,
name: "TLS_RSA_WITH_AES_256_CBC_SHA256",
kex: "RSA",
enc: "AES-CBC-256",
mac: "HMAC-SHA256",
strength: 256,
is_recommended: false,
},
{
id: 0x009c,
name: "TLS_RSA_WITH_AES_128_GCM_SHA256",
kex: "RSA",
enc: "AES-GCM-128",
mac: "AEAD",
strength: 128,
is_recommended: false,
},
{
id: 0x009d,
name: "TLS_RSA_WITH_AES_256_GCM_SHA384",
kex: "RSA",
enc: "AES-GCM-256",
mac: "AEAD",
strength: 256,
is_recommended: false,
},
// Null Encryption Ciphers (Vulnerable - Plaintext leakage)
{
id: 0x0001,
name: "TLS_RSA_WITH_NULL_MD5",
kex: "RSA",
enc: "NULL",
mac: "HMAC-MD5",
strength: 0,
is_recommended: false,
},
{
id: 0x0002,
name: "TLS_RSA_WITH_NULL_SHA",
kex: "RSA",
enc: "NULL",
mac: "HMAC-SHA1",
strength: 0,
is_recommended: false,
},
{
id: 0x002c,
name: "TLS_RSA_WITH_NULL_SHA256",
kex: "RSA",
enc: "NULL",
mac: "HMAC-SHA256",
strength: 0,
is_recommended: false,
},
{
id: 0xc001,
name: "TLS_ECDH_ECDSA_WITH_NULL_SHA",
kex: "ECDH",
enc: "NULL",
mac: "HMAC-SHA1",
strength: 0,
is_recommended: false,
},
{
id: 0xc006,
name: "TLS_ECDHE_ECDSA_WITH_NULL_SHA",
kex: "ECDHE",
enc: "NULL",
mac: "HMAC-SHA1",
strength: 0,
is_recommended: false,
},
{
id: 0xc010,
name: "TLS_ECDHE_RSA_WITH_NULL_SHA",
kex: "ECDHE",
enc: "NULL",
mac: "HMAC-SHA1",
strength: 0,
is_recommended: false,
},
// RC4 Encryption Ciphers (Vulnerable - Broken stream cipher)
{
id: 0x0004,
name: "TLS_RSA_WITH_RC4_128_MD5",
kex: "RSA",
enc: "RC4-128",
mac: "HMAC-MD5",
strength: 128,
is_recommended: false,
},
{
id: 0x0005,
name: "TLS_RSA_WITH_RC4_128_SHA",
kex: "RSA",
enc: "RC4-128",
mac: "HMAC-SHA1",
strength: 128,
is_recommended: false,
},
{
id: 0x0018,
name: "TLS_DH_anon_WITH_RC4_128_MD5",
kex: "DH_anon",
enc: "RC4-128",
mac: "HMAC-MD5",
strength: 128,
is_recommended: false,
},
{
id: 0xc002,
name: "TLS_ECDH_ECDSA_WITH_RC4_128_SHA",
kex: "ECDH",
enc: "RC4-128",
mac: "HMAC-SHA1",
strength: 128,
is_recommended: false,
},
{
id: 0xc007,
name: "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA",
kex: "ECDHE",
enc: "RC4-128",
mac: "HMAC-SHA1",
strength: 128,
is_recommended: false,
},
{
id: 0xc011,
name: "TLS_ECDHE_RSA_WITH_RC4_128_SHA",
kex: "ECDHE",
enc: "RC4-128",
mac: "HMAC-SHA1",
strength: 128,
is_recommended: false,
},
// Export-Grade Ciphers (Vulnerable - Artificially weakened cryptography)
{
id: 0x0003,
name: "TLS_RSA_EXPORT_WITH_RC4_40_MD5",
kex: "RSA_EXPORT",
enc: "RC4-40",
mac: "HMAC-MD5",
strength: 40,
is_recommended: false,
},
{
id: 0x0006,
name: "TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5",
kex: "RSA_EXPORT",
enc: "RC2-CBC-40",
mac: "HMAC-MD5",
strength: 40,
is_recommended: false,
},
{
id: 0x0008,
name: "TLS_RSA_EXPORT_WITH_DES40_CBC_SHA",
kex: "RSA_EXPORT",
enc: "DES-CBC-40",
mac: "HMAC-SHA1",
strength: 40,
is_recommended: false,
},
{
id: 0x000b,
name: "TLS_DH_dss_EXPORT_WITH_DES40_CBC_SHA",
kex: "DH_dss_EXPORT",
enc: "DES-CBC-40",
mac: "HMAC-SHA1",
strength: 40,
is_recommended: false,
},
{
id: 0x000e,
name: "TLS_DH_rsa_EXPORT_WITH_DES40_CBC_SHA",
kex: "DH_rsa_EXPORT",
enc: "DES-CBC-40",
mac: "HMAC-SHA1",
strength: 40,
is_recommended: false,
},
{
id: 0x0011,
name: "TLS_DHE_dss_EXPORT_WITH_DES40_CBC_SHA",
kex: "DHE_dss_EXPORT",
enc: "DES-CBC-40",
mac: "HMAC-SHA1",
strength: 40,
is_recommended: false,
},
{
id: 0x0014,
name: "TLS_DHE_rsa_EXPORT_WITH_DES40_CBC_SHA",
kex: "DHE_rsa_EXPORT",
enc: "DES-CBC-40",
mac: "HMAC-SHA1",
strength: 40,
is_recommended: false,
},
// Camellia GCM Ciphers (RFC 6367)
{
id: 0xc07a,
name: "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256",
kex: "ECDHE",
enc: "CAMELLIA-GCM-128",
mac: "AEAD",
strength: 128,
is_recommended: false,
},
{
id: 0xc07b,
name: "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384",
kex: "ECDHE",
enc: "CAMELLIA-GCM-256",
mac: "AEAD",
strength: 256,
is_recommended: false,
},
{
id: 0xc07c,
name: "TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256",
kex: "ECDH",
enc: "CAMELLIA-GCM-128",
mac: "AEAD",
strength: 128,
is_recommended: false,
},
{
id: 0xc07d,
name: "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384",
kex: "ECDH",
enc: "CAMELLIA-GCM-256",
mac: "AEAD",
strength: 256,
is_recommended: false,
},
{
id: 0xc07e,
name: "TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256",
kex: "ECDHE",
enc: "CAMELLIA-GCM-128",
mac: "AEAD",
strength: 128,
is_recommended: false,
},
{
id: 0xc07f,
name: "TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384",
kex: "ECDHE",
enc: "CAMELLIA-GCM-256",
mac: "AEAD",
strength: 256,
is_recommended: false,
},
{
id: 0xc080,
name: "TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256",
kex: "ECDH",
enc: "CAMELLIA-GCM-128",
mac: "AEAD",
strength: 128,
is_recommended: false,
},
{
id: 0xc081,
name: "TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384",
kex: "ECDH",
enc: "CAMELLIA-GCM-256",
mac: "AEAD",
strength: 256,
is_recommended: false,
},
// ARIA GCM Ciphers (RFC 8263)
{
id: 0xc0af,
name: "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256",
kex: "ECDHE",
enc: "ARIA-GCM-128",
mac: "AEAD",
strength: 128,
is_recommended: false,
},
{
id: 0xc0b0,
name: "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384",
kex: "ECDHE",
enc: "ARIA-GCM-256",
mac: "AEAD",
strength: 256,
is_recommended: false,
},
{
id: 0xc0b1,
name: "TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256",
kex: "ECDH",
enc: "ARIA-GCM-128",
mac: "AEAD",
strength: 128,
is_recommended: false,
},
{
id: 0xc0b2,
name: "TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384",
kex: "ECDH",
enc: "ARIA-GCM-256",
mac: "AEAD",
strength: 256,
is_recommended: false,
},
{
id: 0xc0b3,
name: "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256",
kex: "ECDHE",
enc: "ARIA-GCM-128",
mac: "AEAD",
strength: 128,
is_recommended: false,
},
{
id: 0xc0b4,
name: "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384",
kex: "ECDHE",
enc: "ARIA-GCM-256",
mac: "AEAD",
strength: 256,
is_recommended: false,
},
{
id: 0xc0b5,
name: "TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256",
kex: "ECDH",
enc: "ARIA-GCM-128",
mac: "AEAD",
strength: 128,
is_recommended: false,
},
{
id: 0x0013,
name: "TLS_DHE_dss_EXPORT_WITH_DES40_CBC_SHA",
kex: "DHE_dss_EXPORT",
enc: "DES-CBC-40",
mac: "HMAC-SHA1",
strength: 40,
is_recommended: false,
},
{
id: 0x0016,
name: "TLS_DHE_rsa_EXPORT_WITH_DES40_CBC_SHA",
kex: "DHE_rsa_EXPORT",
enc: "DES-CBC-40",
mac: "HMAC-SHA1",
strength: 40,
is_recommended: false,
},
]
///|
pub fn lookup_cipher_details(id : UInt16) -> CipherDetails? {
for entry in cipher_details_db {
if entry.id == id {
return Some(entry)
}
}
None
}
///|
pub fn cipher_details_db_size() -> Int {
cipher_details_db.length()
}