Not much changes since last scan, just continuation of established trends. As always, detailed analysis on my blog: https://securitypitfalls.wordpress.com/2015/05/23/april-2015-scan-results/ SSL/TLS survey of 484573 websites from Alexa's top 1 million Stats only from connections that did provide valid certificates (or anonymous DH from servers that do also have valid certificate installed) Supported Ciphers Count Percent -------------------------+---------+------- 3DES 406786 83.9473 3DES Only 794 0.1639 AES 472659 97.5413 AES Only 10959 2.2616 AES-CBC 472558 97.5205 AES-CBC Only 4829 0.9965 AES-GCM 303174 62.5652 AES-GCM Only 29 0.006 CAMELLIA 209131 43.1578 CAMELLIA Only 1 0.0002 CHACHA20 58829 12.1404 CHACHA20 Only 37 0.0076 Insecure 77058 15.9022 RC4 292575 60.3779 RC4 Only 2401 0.4955 RC4 Preferred 45677 9.4262 RC4 forced in TLS1.1+ 27055 5.5833 x:FF 29 RC4 Only 2759 0.5694 x:FF 29 RC4 Preferred 50228 10.3654 x:FF 29 incompatible 166 0.0343 x:FF 35 RC4 Only 3002 0.6195 x:FF 35 RC4 Preferred 50330 10.3865 x:FF 35 incompatible 169 0.0349 y:DHE-RSA-SEED-SHA 106435 21.9647 y:IDEA-CBC-SHA 86288 17.807 y:SEED-SHA 104010 21.4643 z:ADH-AES128-GCM-SHA256 403 0.0832 z:ADH-AES128-SHA 1245 0.2569 z:ADH-AES128-SHA256 285 0.0588 z:ADH-AES256-GCM-SHA384 411 0.0848 z:ADH-AES256-SHA 1251 0.2582 z:ADH-AES256-SHA256 288 0.0594 z:ADH-CAMELLIA128-SHA 757 0.1562 z:ADH-CAMELLIA256-SHA 767 0.1583 z:ADH-DES-CBC-SHA 370 0.0764 z:ADH-DES-CBC3-SHA 1264 0.2608 z:ADH-RC4-MD5 1068 0.2204 z:ADH-SEED-SHA 624 0.1288 z:AECDH-AES128-SHA 14597 3.0123 z:AECDH-AES256-SHA 14601 3.0132 z:AECDH-DES-CBC3-SHA 14555 3.0037 z:AECDH-NULL-SHA 33 0.0068 z:AECDH-RC4-SHA 13915 2.8716 z:DES-CBC-MD5 15676 3.235 z:DES-CBC-SHA 43379 8.952 z:DES-CBC3-MD5 29965 6.1838 z:ECDHE-RSA-NULL-SHA 39 0.008 z:EDH-RSA-DES-CBC-SHA 36816 7.5976 z:EXP-ADH-DES-CBC-SHA 296 0.0611 z:EXP-ADH-RC4-MD5 298 0.0615 z:EXP-DES-CBC-SHA 23304 4.8092 z:EXP-EDH-RSA-DES-CBC-SHA 18924 3.9053 z:EXP-RC2-CBC-MD5 27382 5.6507 z:EXP-RC4-MD5 29880 6.1663 z:EXP1024-DES-CBC-SHA 7448 1.537 z:EXP1024-RC4-SHA 7538 1.5556 z:IDEA-CBC-MD5 2648 0.5465 z:NULL-MD5 269 0.0555 z:NULL-SHA 277 0.0572 z:NULL-SHA256 17 0.0035 z:RC2-CBC-MD5 16012 3.3044 z:RC4-64-MD5 1266 0.2613 Cipher ordering Count Percent -------------------------+---------+------- Client side 137690 28.4147 Server side 346883 71.5853 Supported Handshakes Count Percent -------------------------+---------+------- ADH 1408 0.2906 AECDH 14635 3.0202 DHE 270437 55.8093 ECDHE 323781 66.8178 ECDHE and DHE 176359 36.3947 RSA 446206 92.0823 Supported PFS Count Percent PFS Percent -------------------------+---------+--------+----------- DH,1024bits 223209 46.063 82.5364 DH,1536bits 1 0.0002 0.0004 DH,2048bits 43655 9.009 16.1424 DH,2236bits 3 0.0006 0.0011 DH,2430bits 1 0.0002 0.0004 DH,3072bits 21 0.0043 0.0078 DH,4096bits 2722 0.5617 1.0065 DH,512bits 78 0.0161 0.0288 DH,768bits 777 0.1603 0.2873 DH,8192bits 1 0.0002 0.0004 ECDH,B-163,163bits 5 0.001 0.0015 ECDH,B-571,570bits 986 0.2035 0.3045 ECDH,K-163,163bits 1 0.0002 0.0003 ECDH,K-571,570bits 1 0.0002 0.0003 ECDH,P-224,224bits 41 0.0085 0.0127 ECDH,P-256,256bits 316799 65.3769 97.8436 ECDH,P-384,384bits 3387 0.699 1.0461 ECDH,P-521,521bits 4921 1.0155 1.5199 Prefer DH,1024bits 90273 18.6294 33.3804 Prefer DH,2048bits 2959 0.6106 1.0942 Prefer DH,2236bits 1 0.0002 0.0004 Prefer DH,4096bits 100 0.0206 0.037 Prefer DH,512bits 3 0.0006 0.0011 Prefer DH,768bits 394 0.0813 0.1457 Prefer ECDH,B-163,163bits 5 0.001 0.0015 Prefer ECDH,B-571,570bits 777 0.1603 0.24 Prefer ECDH,K-163,163bits 1 0.0002 0.0003 Prefer ECDH,K-571,570bits 1 0.0002 0.0003 Prefer ECDH,P-224,224bits 16 0.0033 0.0049 Prefer ECDH,P-256,256bits 262300 54.1301 81.0115 Prefer ECDH,P-384,384bits 2417 0.4988 0.7465 Prefer ECDH,P-521,521bits 4606 0.9505 1.4226 Prefer PFS 363853 75.0873 0 Support PFS 417859 86.2324 0 Supported ECC curves Count Percent -------------------------+---------+-------- brainpoolP256r1 275 0.0568 brainpoolP384r1 275 0.0568 brainpoolP512r1 276 0.057 prime192v1 1006 0.2076 prime256v1 322585 66.571 prime256v1 Only 280643 57.9155 secp160k1 973 0.2008 secp160r1 977 0.2016 secp160r2 973 0.2008 secp192k1 994 0.2051 secp224k1 1021 0.2107 secp224r1 1909 0.394 secp224r1 Only 1 0.0002 secp256k1 1031 0.2128 secp384r1 42157 8.6998 secp384r1 Only 214 0.0442 secp521r1 11163 2.3037 secp521r1 Only 85 0.0175 sect163k1 974 0.201 sect163k1 Only 1 0.0002 sect163r1 973 0.2008 sect163r2 978 0.2018 sect163r2 Only 5 0.001 sect193r1 973 0.2008 sect193r2 972 0.2006 sect233k1 1012 0.2088 sect233r1 1012 0.2088 sect239k1 1011 0.2086 sect283k1 1011 0.2086 sect283r1 1011 0.2086 sect409k1 1012 0.2088 sect409r1 1011 0.2086 sect571k1 1023 0.2111 sect571r1 1023 0.2111 Unsupported curve fallback Count Percent ------------------------------+---------+-------- False 79371 16.3796 True 201893 41.6641 order-specific 25 0.0052 unknown 203284 41.9512 ECC curve ordering Count Percent -------------------------+---------+-------- client 1937 0.3997 inconclusive-noecc 23 0.0047 server 320951 66.2338 unknown 161662 33.3617 TLSv1.2 PFS supported sigalgs Count Percent ------------------------------+---------+-------- ECDSA-SHA1 29961 6.183 ECDSA-SHA224 29962 6.1832 ECDSA-SHA256 29968 6.1844 ECDSA-SHA384 29969 6.1846 ECDSA-SHA512 29973 6.1854 ECDSA-SHA512 Only 4 0.0008 RSA-MD5 138363 28.5536 RSA-SHA1 288373 59.5107 RSA-SHA1 Only 44023 9.0849 RSA-SHA224 233398 48.1657 RSA-SHA256 248405 51.2627 RSA-SHA256 Only 3440 0.7099 RSA-SHA384 234083 48.3071 RSA-SHA512 234329 48.3578 RSA-SHA512 Only 236 0.0487 TLSv1.2 PFS ordering Count Percent ------------------------------+---------+-------- client 213825 44.1265 indeterminate 7 0.0014 intolerant 2102 0.4338 order-fallback 14 0.0029 server 106987 22.0786 unsupported 37608 7.7611 TLSv1.2 PFS sigalg fallback Count Percent ------------------------------+---------+-------- ECDSA SHA1 29954 6.1815 ECDSA intolerant 26 0.0054 ECDSA pfs-rsa-SHA512 2 0.0004 RSA False 136825 28.2362 RSA SHA1 130262 26.8818 RSA intolerant 24807 5.1194 RSA pfs-ecdsa-SHA512 1 0.0002 RSA soft-nopfs 1684 0.3475 Renegotiation Count Percent -------------------------+---------+-------- False 8680 1.7913 insecure 23543 4.8585 secure 452350 93.3502 Compression Count Percent -------------------------+---------+-------- 1 (zlib compression) 13301 2.7449 False 8680 1.7913 NONE 462592 95.4638 TLS session ticket hint Count Percent -------------------------+---------+-------- 1 2 0.0004 1 only 2 0.0004 2 2 0.0004 2 only 2 0.0004 5 2 0.0004 5 only 2 0.0004 10 6 0.0012 10 only 6 0.0012 15 10 0.0021 15 only 10 0.0021 30 8 0.0017 30 only 8 0.0017 60 95 0.0196 60 only 90 0.0186 65 1 0.0002 65 only 1 0.0002 70 6 0.0012 100 13 0.0027 100 only 13 0.0027 120 31 0.0064 120 only 31 0.0064 128 2 0.0004 128 only 2 0.0004 150 2 0.0004 180 46 0.0095 180 only 43 0.0089 240 11 0.0023 240 only 11 0.0023 300 211464 43.6392 300 only 204443 42.1903 360 1 0.0002 400 7 0.0014 400 only 7 0.0014 420 117 0.0241 420 only 65 0.0134 480 13 0.0027 480 only 12 0.0025 500 3 0.0006 500 only 3 0.0006 600 14992 3.0939 600 only 14817 3.0577 660 1 0.0002 660 only 1 0.0002 720 1 0.0002 720 only 1 0.0002 900 527 0.1088 900 only 499 0.103 960 2 0.0004 960 only 2 0.0004 1200 574 0.1185 1200 only 562 0.116 1440 1 0.0002 1440 only 1 0.0002 1500 13 0.0027 1500 only 12 0.0025 1800 368 0.0759 1800 only 362 0.0747 2400 6 0.0012 2400 only 6 0.0012 2700 9 0.0019 2700 only 9 0.0019 3000 12 0.0025 3000 only 12 0.0025 3600 371 0.0766 3600 only 355 0.0733 3900 1 0.0002 3900 only 1 0.0002 4200 1 0.0002 5400 14 0.0029 5400 only 2 0.0004 6000 5 0.001 6000 only 5 0.001 7200 14319 2.955 7200 only 13804 2.8487 10800 1786 0.3686 10800 only 1780 0.3673 14400 1343 0.2772 14400 only 1335 0.2755 18000 11 0.0023 18000 only 11 0.0023 21600 4962 1.024 21600 only 4955 1.0225 28800 10 0.0021 28800 only 9 0.0019 36000 980 0.2022 36000 only 972 0.2006 43200 27 0.0056 43200 only 23 0.0047 60000 1 0.0002 60000 only 1 0.0002 64800 46419 9.5794 64800 only 46415 9.5785 72000 7 0.0014 72000 only 7 0.0014 84600 1 0.0002 84600 only 1 0.0002 86000 34 0.007 86000 only 34 0.007 86400 363 0.0749 86400 only 363 0.0749 100800 12150 2.5074 100800 only 12149 2.5072 129600 9 0.0019 129600 only 9 0.0019 172800 2 0.0004 172800 only 2 0.0004 216000 1 0.0002 216000 only 1 0.0002 432000 1 0.0002 432000 only 1 0.0002 600000 1 0.0002 600000 only 1 0.0002 604800 1 0.0002 604800 only 1 0.0002 864000 3 0.0006 864000 only 3 0.0006 None 181287 37.4117 None only 173413 35.7868 Certificate sig alg Count Percent -------------------------+---------+-------- None 15526 3.2041 ecdsa-with-SHA256 29954 6.1815 sha1WithRSAEncryption 207522 42.8257 sha256WithRSAEncryption 247164 51.0066 sha384WithRSAEncryption 1 0.0002 sha512WithRSAEncryption 11 0.0023 Certificate key size Count Percent -------------------------+---------+-------- ECDSA 256 29979 6.1867 ECDSA 384 5 0.001 RSA 1024 222 0.0458 RSA 10240 3 0.0006 RSA 2028 1 0.0002 RSA 2047 1 0.0002 RSA 2048 437533 90.2925 RSA 2049 3 0.0006 RSA 2056 3 0.0006 RSA 2058 2 0.0004 RSA 2064 2 0.0004 RSA 2080 2 0.0004 RSA 2084 8 0.0017 RSA 2096 1 0.0002 RSA 2408 3 0.0006 RSA 2432 5 0.001 RSA 2612 2 0.0004 RSA 3024 1 0.0002 RSA 3050 1 0.0002 RSA 3071 1 0.0002 RSA 3072 93 0.0192 RSA 3096 1 0.0002 RSA 3102 1 0.0002 RSA 3248 1 0.0002 RSA 3600 1 0.0002 RSA 4042 1 0.0002 RSA 4048 2 0.0004 RSA 4056 30 0.0062 RSA 4069 1 0.0002 RSA 4086 4 0.0008 RSA 4092 10 0.0021 RSA 4096 16685 3.4432 RSA 8192 6 0.0012 RSA/ECDSA Dual Stack 35 0.0072 OCSP stapling Count Percent -------------------------+---------+-------- Supported 85670 17.6795 Unsupported 398903 82.3205 Supported Protocols Count Percent -------------------------+---------+------- SSL2 30248 6.2422 SSL2 Only 63 0.013 SSL3 145442 30.0145 SSL3 Only 993 0.2049 SSL3 or TLS1 Only 92308 19.0493 SSL3 or lower Only 1029 0.2124 TLS1 482080 99.4855 TLS1 Only 53168 10.9721 TLS1 or lower Only 120432 24.8532 TLS1.1 349742 72.1753 TLS1.1 Only 29 0.006 TLS1.1 or up Only 1151 0.2375 TLS1.2 360532 74.402 TLS1.2 Only 703 0.1451 TLS1.2, 1.0 but not 1.1 12562 2.5924 Statistics from 501419 chains provided by 668131 hosts Server provided chains Count Percent -------------------------+---------+------- complete 444722 66.5621 incomplete 28787 4.3086 untrusted 194622 29.1293 Trusted chain statistics ======================== Chain length Count Percent -------------------------+---------+------- 2 466 0.0929 3 419080 83.5788 4 81838 16.3213 5 35 0.007 CA key size in chains Count -------------------------+--------- ECDSA 256 29837 ECDSA 384 29837 RSA 1024 447 RSA 2045 1 RSA 2048 932773 RSA 4096 91385 Chains with CA key Count Percent -------------------------+---------+------- ECDSA 256 29837 5.9505 ECDSA 384 29837 5.9505 RSA 1024 443 0.0883 RSA 2045 1 0.0002 RSA 2048 470954 93.9242 RSA 4096 90510 18.0508 Signature algorithm (ex. root) Count ------------------------------+--------- ecdsa-with-SHA384 29837 sha1WithRSAEncryption 222155 sha256WithRSAEncryption 174421 sha384WithRSAEncryption 156409 sha512WithRSAEncryption 39 Eff. host cert chain LoS Count Percent -------------------------+---------+------- 80 222398 44.3537 112 249181 49.6952 128 29840 5.9511 Root CAs Count Percent ---------------------------------------------+---------+------- (2c543cd1) GeoTrust Global CA 108475 21.6336 (157753a5) AddTrust External CA Root 107019 21.3432 (5ad8a5d6) GlobalSign Root CA 50472 10.0658 (cbf06781) Go Daddy Root Certificate Authorit 44010 8.7771 (eed8c118) COMODO ECC Certification Authority 29832 5.9495 (b204d74a) VeriSign Class 3 Public Primary Ce 27936 5.5714 (2e4eed3c) thawte Primary Root CA 25416 5.0688 (244b5494) DigiCert High Assurance EV Root CA 24612 4.9085 (653b494a) Baltimore CyberTrust Root 11515 2.2965 (ae8153b9) StartCom Certification Authority 9470 1.8886 (f081611a) The Go Daddy Group, Inc. 8925 1.7799 (b13cc6df) UTN-USERFirst-Hardware 8766 1.7482 (f387163d) Starfield Technologies, Inc. 6944 1.3849 (3513523f) DigiCert Global Root CA 6188 1.2341 (480720ec) GeoTrust Primary Certification Aut 5346 1.0662 (40547a79) COMODO Certification Authority 5333 1.0636 Scan performed between 17th and 29th of April 2015 -- Regards, Hubert Kario Quality Engineer, QE BaseOS Security team Web: www.cz.redhat.com Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic
Attachment:
signature.asc
Description: This is a digitally signed message part.
-- security mailing list security@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/security
