Unfortunately during scanning the disk space on the server run out so the results are not complete. Other than that, no interesting developments, just continuation of established trends. SSL/TLS survey of 479178 websites from Alexa's top 1 million Stats only from connections that did provide valid certificates (or anonymous DH from servers that do also have valid certificate installed) Supported Ciphers Count Percent -------------------------+---------+------- 3DES 419340 87.5124 3DES Only 506 0.1056 3DES Preferred 1692 0.3531 3DES forced in TLS1.1+ 922 0.1924 AES 474652 99.0555 AES Only 37306 7.7854 AES-CBC 474138 98.9482 AES-CBC Only 7523 1.57 AES-GCM 380917 79.4938 AES-GCM Only 466 0.0972 CAMELLIA 201933 42.1415 CAMELLIA Only 3 0.0006 CHACHA20 66326 13.8416 CHACHA20 Only 1 0.0002 Insecure 48383 10.0971 RC4 149250 31.1471 RC4 Only 177 0.0369 RC4 Preferred 15506 3.236 RC4 forced in TLS1.1+ 8442 1.7618 x:FF 29 3DES Only 550 0.1148 x:FF 29 3DES Preferred 2012 0.4199 x:FF 29 RC4 Only 265 0.0553 x:FF 29 RC4 Preferred 17097 3.568 x:FF 29 incompatible 321 0.067 x:FF 35 3DES Only 559 0.1167 x:FF 35 3DES Preferred 1924 0.4015 x:FF 35 RC4 Only 311 0.0649 x:FF 35 RC4 Preferred 17124 3.5736 x:FF 35 incompatible 325 0.0678 y:DHE-RSA-SEED-SHA 60590 12.6446 y:IDEA-CBC-SHA 58075 12.1197 y:SEED-SHA 70022 14.6129 z:ADH-AES128-GCM-SHA256 354 0.0739 z:ADH-AES128-SHA 605 0.1263 z:ADH-AES128-SHA256 246 0.0513 z:ADH-AES256-GCM-SHA384 367 0.0766 z:ADH-AES256-SHA 618 0.129 z:ADH-AES256-SHA256 245 0.0511 z:ADH-CAMELLIA128-SHA 316 0.0659 z:ADH-CAMELLIA256-SHA 321 0.067 z:ADH-DES-CBC-SHA 243 0.0507 z:ADH-DES-CBC3-SHA 620 0.1294 z:ADH-RC4-MD5 455 0.095 z:ADH-SEED-SHA 254 0.053 z:AECDH-AES128-SHA 7521 1.5696 z:AECDH-AES256-SHA 7556 1.5769 z:AECDH-DES-CBC3-SHA 7499 1.565 z:AECDH-NULL-SHA 45 0.0094 z:AECDH-RC4-SHA 7010 1.4629 z:DES-CBC-MD5 7605 1.5871 z:DES-CBC-SHA 30728 6.4126 z:DES-CBC3-MD5 17199 3.5893 z:ECDHE-RSA-NULL-SHA 53 0.0111 z:EDH-RSA-DES-CBC-SHA 25945 5.4145 z:EXP-ADH-DES-CBC-SHA 148 0.0309 z:EXP-ADH-RC4-MD5 145 0.0303 z:EXP-DES-CBC-SHA 10647 2.2219 z:EXP-EDH-RSA-DES-CBC-SHA 8346 1.7417 z:EXP-RC2-CBC-MD5 12795 2.6702 z:EXP-RC4-MD5 13391 2.7946 z:EXP1024-DES-CBC-SHA 3415 0.7127 z:EXP1024-RC4-SHA 3465 0.7231 z:IDEA-CBC-MD5 1613 0.3366 z:NULL-MD5 162 0.0338 z:NULL-SHA 169 0.0353 z:NULL-SHA256 38 0.0079 z:RC2-CBC-MD5 7754 1.6182 z:RC4-64-MD5 712 0.1486 Cipher ordering Count Percent -------------------------+---------+------- Client side 116701 24.3544 Server side 362477 75.6456 Supported Handshakes Count Percent -------------------------+---------+------- ADH 753 0.1571 AECDH 7568 1.5794 DHE 255330 53.285 ECDH 2 0.0004 ECDHE 404645 84.4457 ECDHE and DHE 212045 44.2518 RSA 411697 85.9173 Supported PFS Count Percent PFS Percent -------------------------+---------+--------+----------- DH,1024bits 107150 22.3612 41.9653 DH,1338bits 1 0.0002 0.0004 DH,1536bits 1 0.0002 0.0004 DH,2048bits 139444 29.1007 54.6132 DH,2236bits 57 0.0119 0.0223 DH,2432bits 3 0.0006 0.0012 DH,3072bits 93 0.0194 0.0364 DH,3092bits 1 0.0002 0.0004 DH,4096bits 8367 1.7461 3.2769 DH,512bits 52 0.0109 0.0204 DH,768bits 313 0.0653 0.1226 DH,8192bits 7 0.0015 0.0027 ECDH,B-571,570bits 1786 0.3727 0.4414 ECDH,K-163,163bits 1 0.0002 0.0002 ECDH,P-192,192bits 15 0.0031 0.0037 ECDH,P-224,224bits 84 0.0175 0.0208 ECDH,P-256,256bits 389954 81.3798 96.3694 ECDH,P-384,384bits 4297 0.8967 1.0619 ECDH,P-521,521bits 10105 2.1088 2.4973 Prefer DH,1024bits 41750 8.7128 16.3514 Prefer DH,1536bits 1 0.0002 0.0004 Prefer DH,2048bits 4670 0.9746 1.829 Prefer DH,3072bits 7 0.0015 0.0027 Prefer DH,4096bits 333 0.0695 0.1304 Prefer DH,768bits 37 0.0077 0.0145 Prefer ECDH,B-571,570bits 1575 0.3287 0.3892 Prefer ECDH,K-163,163bits 1 0.0002 0.0002 Prefer ECDH,P-224,224bits 81 0.0169 0.02 Prefer ECDH,P-256,256bits 357787 74.6668 88.42 Prefer ECDH,P-384,384bits 3158 0.659 0.7804 Prefer ECDH,P-521,521bits 9166 1.9129 2.2652 Prefer PFS 418566 87.3508 0 Support PFS 447930 93.4788 0 Supported ECC curves Count Percent -------------------------+---------+-------- brainpoolP256r1 5523 1.1526 brainpoolP384r1 5524 1.1528 brainpoolP512r1 5525 1.153 prime192v1 1353 0.2824 prime256v1 401476 83.7843 prime256v1 Only 345957 72.198 secp160k1 1299 0.2711 secp160r1 1304 0.2721 secp160r2 1299 0.2711 secp192k1 1314 0.2742 secp224k1 1392 0.2905 secp224r1 4371 0.9122 secp256k1 7238 1.5105 secp384r1 56063 11.6998 secp384r1 Only 584 0.1219 secp521r1 28028 5.8492 secp521r1 Only 125 0.0261 sect163k1 1310 0.2734 sect163k1 Only 3 0.0006 sect163r1 1306 0.2726 sect163r2 1307 0.2728 sect193r1 1306 0.2726 sect193r2 1304 0.2721 sect233k1 1387 0.2895 sect233r1 1386 0.2892 sect239k1 1383 0.2886 sect283k1 6795 1.4181 sect283k1 Only 1 0.0002 sect283r1 6792 1.4174 sect409k1 6793 1.4176 sect409r1 6793 1.4176 sect571k1 6797 1.4185 sect571r1 6797 1.4185 Unsupported curve fallback Count Percent ------------------------------+---------+-------- False 43974 9.177 True 304974 63.6452 order-specific 61 0.0127 unknown 130169 27.1651 ECC curve ordering Count Percent -------------------------+---------+-------- client 6487 1.3538 inconclusive-noecc 8 0.0017 server 395730 82.5852 unknown 76953 16.0594 TLSv1.2 PFS supported sigalgs Count Percent ------------------------------+---------+-------- ECDSA-SHA1 40044 8.3568 ECDSA-SHA1 Only 3 0.0006 ECDSA-SHA224 40035 8.3549 ECDSA-SHA256 54403 11.3534 ECDSA-SHA384 54398 11.3524 ECDSA-SHA512 54399 11.3526 ECDSA-SHA512 Only 1 0.0002 RSA-MD5 47971 10.0111 RSA-SHA1 347530 72.5263 RSA-SHA1 Only 36263 7.5678 RSA-SHA224 288147 60.1336 RSA-SHA256 318675 66.5045 RSA-SHA256 Only 6467 1.3496 RSA-SHA384 290085 60.538 RSA-SHA384 Only 2 0.0004 RSA-SHA512 290093 60.5397 RSA-SHA512 Only 126 0.0263 TLSv1.2 PFS ordering Count Percent ------------------------------+---------+-------- client 215610 44.9958 indeterminate 32 0.0067 intolerant 4623 0.9648 order-fallback 3 0.0006 server 175045 36.5303 unsupported 17219 3.5934 TLSv1.2 PFS sigalg fallback Count Percent ------------------------------+---------+-------- ECDSA SHA1 40031 8.3541 ECDSA intolerant 47 0.0098 ECDSA pfs-rsa-SHA512 14337 2.992 ECDSA soft-nopfs 1 0.0002 RSA False 47573 9.928 RSA SHA1 274148 57.2121 RSA intolerant 34088 7.1138 RSA pfs-ecdsa-SHA512 4 0.0008 RSA soft-nopfs 498 0.1039 Renegotiation Count Percent -------------------------+---------+-------- False 5212 1.0877 insecure 15480 3.2305 secure 458486 95.6818 Compression Count Percent -------------------------+---------+-------- 1 (zlib compression) 7370 1.5381 False 5212 1.0877 NONE 466596 97.3743 TLS session ticket hint Count Percent -------------------------+---------+-------- 1 4 0.0008 1 only 4 0.0008 2 1 0.0002 2 only 1 0.0002 10 6 0.0013 10 only 6 0.0013 15 5 0.001 15 only 5 0.001 30 18 0.0038 30 only 17 0.0035 60 142 0.0296 60 only 138 0.0288 65 1 0.0002 65 only 1 0.0002 70 6 0.0013 100 15 0.0031 100 only 15 0.0031 120 24 0.005 120 only 24 0.005 128 3 0.0006 128 only 3 0.0006 150 1 0.0002 180 58 0.0121 180 only 55 0.0115 240 7 0.0015 240 only 7 0.0015 244 1 0.0002 244 only 1 0.0002 300 230415 48.0855 300 only 226909 47.3538 302 2 0.0004 302 only 2 0.0004 360 3 0.0006 360 only 1 0.0002 400 7 0.0015 400 only 7 0.0015 420 116 0.0242 420 only 93 0.0194 480 10 0.0021 480 only 10 0.0021 500 4 0.0008 500 only 4 0.0008 540 2 0.0004 540 only 2 0.0004 600 23920 4.9919 600 only 23758 4.9581 660 1 0.0002 660 only 1 0.0002 840 1 0.0002 840 only 1 0.0002 900 983 0.2051 900 only 962 0.2008 960 3 0.0006 960 only 3 0.0006 1000 1 0.0002 1000 only 1 0.0002 1200 2630 0.5489 1200 only 2627 0.5482 1320 1 0.0002 1320 only 1 0.0002 1500 2 0.0004 1500 only 1 0.0002 1800 500 0.1043 1800 only 491 0.1025 1980 2 0.0004 1980 only 2 0.0004 2100 2 0.0004 2100 only 1 0.0002 2400 7 0.0015 2400 only 7 0.0015 2700 10 0.0021 2700 only 10 0.0021 3000 26 0.0054 3000 only 26 0.0054 3600 664 0.1386 3600 only 655 0.1367 3900 1 0.0002 3900 only 1 0.0002 5160 1 0.0002 5160 only 1 0.0002 5400 15 0.0031 5400 only 8 0.0017 6000 214 0.0447 6000 only 214 0.0447 7200 14927 3.1151 7200 only 14908 3.1112 10800 3286 0.6858 10800 only 3277 0.6839 14400 93 0.0194 14400 only 91 0.019 18000 9 0.0019 18000 only 9 0.0019 21600 3668 0.7655 21600 only 3668 0.7655 25200 1 0.0002 25200 only 1 0.0002 28800 1854 0.3869 28800 only 1853 0.3867 36000 954 0.1991 36000 only 945 0.1972 43200 39 0.0081 43200 only 39 0.0081 60000 1 0.0002 60000 only 1 0.0002 64800 56248 11.7384 64800 only 56243 11.7374 72000 21 0.0044 72000 only 21 0.0044 79200 1 0.0002 79200 only 1 0.0002 86000 44 0.0092 86000 only 44 0.0092 86400 2743 0.5724 86400 only 2734 0.5706 100800 8629 1.8008 100800 only 8618 1.7985 115200 1 0.0002 115200 only 1 0.0002 129600 7 0.0015 129600 only 7 0.0015 172800 9 0.0019 172800 only 9 0.0019 216000 2 0.0004 216000 only 2 0.0004 259200 2 0.0004 259200 only 2 0.0004 432000 1 0.0002 432000 only 1 0.0002 604800 2 0.0004 864000 3 0.0006 864000 only 3 0.0006 7776000 2 0.0004 7776000 only 2 0.0004 None 130619 27.259 None only 126799 26.4618 Certificate sig alg Count Percent -------------------------+---------+-------- None 8093 1.6889 ecdsa-with-SHA256 54346 11.3415 sha1WithRSAEncryption 32309 6.7426 sha256WithRSAEncryption 406902 84.9167 sha384WithRSAEncryption 3 0.0006 sha512WithRSAEncryption 52 0.0109 Certificate key size Count Percent -------------------------+---------+-------- ECDSA 256 54398 11.3524 ECDSA 384 18 0.0038 ECDSA 521 1 0.0002 RSA 1024 28 0.0058 RSA 2048 416954 87.0144 RSA 2049 3 0.0006 RSA 2056 2 0.0004 RSA 2058 2 0.0004 RSA 2084 4 0.0008 RSA 2086 1 0.0002 RSA 2096 2 0.0004 RSA 2432 1 0.0002 RSA 3071 1 0.0002 RSA 3072 118 0.0246 RSA 3073 1 0.0002 RSA 3076 2 0.0004 RSA 3096 2 0.0004 RSA 3248 2 0.0004 RSA 4048 1 0.0002 RSA 4056 17 0.0035 RSA 4092 7 0.0015 RSA 4094 1 0.0002 RSA 4096 22025 4.5964 RSA 4098 1 0.0002 RSA 8192 4 0.0008 RSA 8392 1 0.0002 RSA/ECDSA Dual Stack 14407 3.0066 OCSP stapling Count Percent -------------------------+---------+-------- Supported 112039 23.3815 Unsupported 367139 76.6185 Supported Protocols Count Percent -------------------------+---------+------- SSL2 17376 3.6262 SSL2 Only 10 0.0021 SSL3 93563 19.5257 SSL3 Only 980 0.2045 SSL3 or TLS1 Only 47829 9.9815 SSL3 or lower Only 992 0.207 TLS1 472039 98.5102 TLS1 Only 29199 6.0936 TLS1 or lower Only 63377 13.2262 TLS1.1 404578 84.4317 TLS1.1 Only 297 0.062 TLS1.1 or up Only 5984 1.2488 TLS1.2 412518 86.0887 TLS1.2 Only 2158 0.4504 TLS1.2, 1.0 but not 1.1 7981 1.6656 Statistics from 487333 chains provided by 621854 hosts Server provided chains Count Percent -------------------------+---------+------- complete 436283 70.1584 incomplete 20784 3.3423 untrusted 164787 26.4993 Trusted chain statistics ======================== Chain length Count Percent -------------------------+---------+------- 2 12 0.0025 3 485364 99.596 4 1945 0.3991 5 12 0.0025 CA key size in chains Count -------------------------+--------- ECDSA 256 42987 ECDSA 384 42988 RSA 1024 28 RSA 2045 2 RSA 2048 746942 RSA 4096 143676 Chains with CA key Count Percent -------------------------+---------+------- ECDSA 256 42987 8.8209 ECDSA 384 42988 8.8211 RSA 1024 26 0.0053 RSA 2045 2 0.0004 RSA 2048 443976 91.1032 RSA 4096 143127 29.3694 Signature algorithm (ex. root) Count ------------------------------+--------- ecdsa-with-SHA384 42983 sha1WithRSAEncryption 37695 sha256WithRSAEncryption 279113 sha384WithRSAEncryption 129437 sha512WithRSAEncryption 62 Eff. host cert chain LoS Count Percent -------------------------+---------+------- 80 37722 7.7405 112 406613 83.4364 128.0 42998 8.8231 Root CAs Count Percent ---------------------------------------------+---------+------- (d6325660) COMODO RSA Certification Authority 115692 23.7398 (2c543cd1) GeoTrust Global CA 85975 17.6419 (cbf06781) Go Daddy Root Certificate Authorit 43560 8.9384 (eed8c118) COMODO ECC Certification Authority 42977 8.8188 (5ad8a5d6) GlobalSign Root CA 41299 8.4745 (b204d74a) VeriSign Class 3 Public Primary Ce 28043 5.7544 (244b5494) DigiCert High Assurance EV Root CA 18414 3.7785 (2e4eed3c) thawte Primary Root CA 17524 3.5959 (fc5a8f99) USERTrust RSA Certification Author 13626 2.796 (653b494a) Baltimore CyberTrust Root 10432 2.1406 (3513523f) DigiCert Global Root CA 8525 1.7493 (ae8153b9) StartCom Certification Authority 7668 1.5735 (4bfab552) Starfield Root Certificate Authori 7663 1.5724 (480720ec) GeoTrust Primary Certification Aut 4978 1.0215 Scan performed between 22nd of February and 16th of March 2016 -- Regards, Hubert Kario Senior Quality Engineer, QE BaseOS Security team Web: www.cz.redhat.com Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic
Attachment:
signature.asc
Description: This is a digitally signed message part.
-- security mailing list security@xxxxxxxxxxxxxxxxxxxxxxx https://lists.fedoraproject.org/admin/lists/security@xxxxxxxxxxxxxxxxxxxxxxx
