Mercurial > hgrepos > Python2 > PyMuPDF

comparison mupdf-source/thirdparty/curl/docs/CIPHERS.md @ 2:b50eed0cc0ef upstream

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
ADD: MuPDF v1.26.7: the MuPDF source as downloaded by a default build of PyMuPDF 1.26.4. The directory name has changed: no version number in the expanded directory now.
author Franz Glasner <fzglas.hg@dom66.de>
date Mon, 15 Sep 2025 11:43:07 +0200
parents
children
comparison
equal deleted inserted replaced
1:1d09e1dec1d9 2:b50eed0cc0ef
1 # Ciphers
2
3 With curl's options
4 [`CURLOPT_SSL_CIPHER_LIST`](https://curl.haxx.se/libcurl/c/CURLOPT_SSL_CIPHER_LIST.html)
5 and
6 [`--ciphers`](https://curl.haxx.se/docs/manpage.html#--ciphers)
7 users can control which ciphers to consider when negotiating TLS connections.
8
9 TLS 1.3 ciphers are supported since curl 7.61 for OpenSSL 1.1.1+ with options
10 [`CURLOPT_TLS13_CIPHERS`](https://curl.haxx.se/libcurl/c/CURLOPT_TLS13_CIPHERS.html)
11 and
12 [`--tls13-ciphers`](https://curl.haxx.se/docs/manpage.html#--tls13-ciphers)
13 . If you are using a different SSL backend you can try setting TLS 1.3 cipher
14 suites by using the respective regular cipher option.
15
16 The names of the known ciphers differ depending on which TLS backend that
17 libcurl was built to use. This is an attempt to list known cipher names.
18
19 ## OpenSSL
20
21 (based on [OpenSSL docs](https://www.openssl.org/docs/man1.1.0/apps/ciphers.html))
22
23 When specifying multiple cipher names, separate them with colon (`:`).
24
25 ### SSL3 cipher suites
26
27 `NULL-MD5`
28 `NULL-SHA`
29 `RC4-MD5`
30 `RC4-SHA`
31 `IDEA-CBC-SHA`
32 `DES-CBC3-SHA`
33 `DH-DSS-DES-CBC3-SHA`
34 `DH-RSA-DES-CBC3-SHA`
35 `DHE-DSS-DES-CBC3-SHA`
36 `DHE-RSA-DES-CBC3-SHA`
37 `ADH-RC4-MD5`
38 `ADH-DES-CBC3-SHA`
39
40 ### TLS v1.0 cipher suites
41
42 `NULL-MD5`
43 `NULL-SHA`
44 `RC4-MD5`
45 `RC4-SHA`
46 `IDEA-CBC-SHA`
47 `DES-CBC3-SHA`
48 `DHE-DSS-DES-CBC3-SHA`
49 `DHE-RSA-DES-CBC3-SHA`
50 `ADH-RC4-MD5`
51 `ADH-DES-CBC3-SHA`
52
53 ### AES ciphersuites from RFC3268, extending TLS v1.0
54
55 `AES128-SHA`
56 `AES256-SHA`
57 `DH-DSS-AES128-SHA`
58 `DH-DSS-AES256-SHA`
59 `DH-RSA-AES128-SHA`
60 `DH-RSA-AES256-SHA`
61 `DHE-DSS-AES128-SHA`
62 `DHE-DSS-AES256-SHA`
63 `DHE-RSA-AES128-SHA`
64 `DHE-RSA-AES256-SHA`
65 `ADH-AES128-SHA`
66 `ADH-AES256-SHA`
67
68 ### SEED ciphersuites from RFC4162, extending TLS v1.0
69
70 `SEED-SHA`
71 `DH-DSS-SEED-SHA`
72 `DH-RSA-SEED-SHA`
73 `DHE-DSS-SEED-SHA`
74 `DHE-RSA-SEED-SHA`
75 `ADH-SEED-SHA`
76
77 ### GOST ciphersuites, extending TLS v1.0
78
79 `GOST94-GOST89-GOST89`
80 `GOST2001-GOST89-GOST89`
81 `GOST94-NULL-GOST94`
82 `GOST2001-NULL-GOST94`
83
84 ### Elliptic curve cipher suites
85
86 `ECDHE-RSA-NULL-SHA`
87 `ECDHE-RSA-RC4-SHA`
88 `ECDHE-RSA-DES-CBC3-SHA`
89 `ECDHE-RSA-AES128-SHA`
90 `ECDHE-RSA-AES256-SHA`
91 `ECDHE-ECDSA-NULL-SHA`
92 `ECDHE-ECDSA-RC4-SHA`
93 `ECDHE-ECDSA-DES-CBC3-SHA`
94 `ECDHE-ECDSA-AES128-SHA`
95 `ECDHE-ECDSA-AES256-SHA`
96 `AECDH-NULL-SHA`
97 `AECDH-RC4-SHA`
98 `AECDH-DES-CBC3-SHA`
99 `AECDH-AES128-SHA`
100 `AECDH-AES256-SHA`
101
102 ### TLS v1.2 cipher suites
103
104 `NULL-SHA256`
105 `AES128-SHA256`
106 `AES256-SHA256`
107 `AES128-GCM-SHA256`
108 `AES256-GCM-SHA384`
109 `DH-RSA-AES128-SHA256`
110 `DH-RSA-AES256-SHA256`
111 `DH-RSA-AES128-GCM-SHA256`
112 `DH-RSA-AES256-GCM-SHA384`
113 `DH-DSS-AES128-SHA256`
114 `DH-DSS-AES256-SHA256`
115 `DH-DSS-AES128-GCM-SHA256`
116 `DH-DSS-AES256-GCM-SHA384`
117 `DHE-RSA-AES128-SHA256`
118 `DHE-RSA-AES256-SHA256`
119 `DHE-RSA-AES128-GCM-SHA256`
120 `DHE-RSA-AES256-GCM-SHA384`
121 `DHE-DSS-AES128-SHA256`
122 `DHE-DSS-AES256-SHA256`
123 `DHE-DSS-AES128-GCM-SHA256`
124 `DHE-DSS-AES256-GCM-SHA384`
125 `ECDHE-RSA-AES128-SHA256`
126 `ECDHE-RSA-AES256-SHA384`
127 `ECDHE-RSA-AES128-GCM-SHA256`
128 `ECDHE-RSA-AES256-GCM-SHA384`
129 `ECDHE-ECDSA-AES128-SHA256`
130 `ECDHE-ECDSA-AES256-SHA384`
131 `ECDHE-ECDSA-AES128-GCM-SHA256`
132 `ECDHE-ECDSA-AES256-GCM-SHA384`
133 `ADH-AES128-SHA256`
134 `ADH-AES256-SHA256`
135 `ADH-AES128-GCM-SHA256`
136 `ADH-AES256-GCM-SHA384`
137 `AES128-CCM`
138 `AES256-CCM`
139 `DHE-RSA-AES128-CCM`
140 `DHE-RSA-AES256-CCM`
141 `AES128-CCM8`
142 `AES256-CCM8`
143 `DHE-RSA-AES128-CCM8`
144 `DHE-RSA-AES256-CCM8`
145 `ECDHE-ECDSA-AES128-CCM`
146 `ECDHE-ECDSA-AES256-CCM`
147 `ECDHE-ECDSA-AES128-CCM8`
148 `ECDHE-ECDSA-AES256-CCM8`
149
150 ### Camellia HMAC-Based ciphersuites from RFC6367, extending TLS v1.2
151
152 `ECDHE-ECDSA-CAMELLIA128-SHA256`
153 `ECDHE-ECDSA-CAMELLIA256-SHA384`
154 `ECDHE-RSA-CAMELLIA128-SHA256`
155 `ECDHE-RSA-CAMELLIA256-SHA384`
156
157 ### TLS 1.3 cipher suites
158
159 (Note these ciphers are set with `CURLOPT_TLS13_CIPHERS` and `--tls13-ciphers`)
160
161 `TLS_AES_256_GCM_SHA384`
162 `TLS_CHACHA20_POLY1305_SHA256`
163 `TLS_AES_128_GCM_SHA256`
164 `TLS_AES_128_CCM_8_SHA256`
165 `TLS_AES_128_CCM_SHA256`
166
167 ## NSS
168
169 ### Totally insecure
170
171 `rc4`
172 `rc4-md5`
173 `rc4export`
174 `rc2`
175 `rc2export`
176 `des`
177 `desede3`
178
179 ### SSL3/TLS cipher suites
180
181 `rsa_rc4_128_md5`
182 `rsa_rc4_128_sha`
183 `rsa_3des_sha`
184 `rsa_des_sha`
185 `rsa_rc4_40_md5`
186 `rsa_rc2_40_md5`
187 `rsa_null_md5`
188 `rsa_null_sha`
189 `fips_3des_sha`
190 `fips_des_sha`
191 `fortezza`
192 `fortezza_rc4_128_sha`
193 `fortezza_null`
194
195 ### TLS 1.0 Exportable 56-bit Cipher Suites
196
197 `rsa_des_56_sha`
198 `rsa_rc4_56_sha`
199
200 ### AES ciphers
201
202 `dhe_dss_aes_128_cbc_sha`
203 `dhe_dss_aes_256_cbc_sha`
204 `dhe_rsa_aes_128_cbc_sha`
205 `dhe_rsa_aes_256_cbc_sha`
206 `rsa_aes_128_sha`
207 `rsa_aes_256_sha`
208
209 ### ECC ciphers
210
211 `ecdh_ecdsa_null_sha`
212 `ecdh_ecdsa_rc4_128_sha`
213 `ecdh_ecdsa_3des_sha`
214 `ecdh_ecdsa_aes_128_sha`
215 `ecdh_ecdsa_aes_256_sha`
216 `ecdhe_ecdsa_null_sha`
217 `ecdhe_ecdsa_rc4_128_sha`
218 `ecdhe_ecdsa_3des_sha`
219 `ecdhe_ecdsa_aes_128_sha`
220 `ecdhe_ecdsa_aes_256_sha`
221 `ecdh_rsa_null_sha`
222 `ecdh_rsa_128_sha`
223 `ecdh_rsa_3des_sha`
224 `ecdh_rsa_aes_128_sha`
225 `ecdh_rsa_aes_256_sha`
226 `ecdhe_rsa_null`
227 `ecdhe_rsa_rc4_128_sha`
228 `ecdhe_rsa_3des_sha`
229 `ecdhe_rsa_aes_128_sha`
230 `ecdhe_rsa_aes_256_sha`
231 `ecdh_anon_null_sha`
232 `ecdh_anon_rc4_128sha`
233 `ecdh_anon_3des_sha`
234 `ecdh_anon_aes_128_sha`
235 `ecdh_anon_aes_256_sha`
236
237 ### HMAC-SHA256 cipher suites
238
239 `rsa_null_sha_256`
240 `rsa_aes_128_cbc_sha_256`
241 `rsa_aes_256_cbc_sha_256`
242 `dhe_rsa_aes_128_cbc_sha_256`
243 `dhe_rsa_aes_256_cbc_sha_256`
244 `ecdhe_ecdsa_aes_128_cbc_sha_256`
245 `ecdhe_rsa_aes_128_cbc_sha_256`
246
247 ### AES GCM cipher suites in RFC 5288 and RFC 5289
248
249 `rsa_aes_128_gcm_sha_256`
250 `dhe_rsa_aes_128_gcm_sha_256`
251 `dhe_dss_aes_128_gcm_sha_256`
252 `ecdhe_ecdsa_aes_128_gcm_sha_256`
253 `ecdh_ecdsa_aes_128_gcm_sha_256`
254 `ecdhe_rsa_aes_128_gcm_sha_256`
255 `ecdh_rsa_aes_128_gcm_sha_256`
256
257 ### cipher suites using SHA384
258
259 `rsa_aes_256_gcm_sha_384`
260 `dhe_rsa_aes_256_gcm_sha_384`
261 `dhe_dss_aes_256_gcm_sha_384`
262 `ecdhe_ecdsa_aes_256_sha_384`
263 `ecdhe_rsa_aes_256_sha_384`
264 `ecdhe_ecdsa_aes_256_gcm_sha_384`
265 `ecdhe_rsa_aes_256_gcm_sha_384`
266
267 ### chacha20-poly1305 cipher suites
268
269 `ecdhe_rsa_chacha20_poly1305_sha_256`
270 `ecdhe_ecdsa_chacha20_poly1305_sha_256`
271 `dhe_rsa_chacha20_poly1305_sha_256`
272
273 ### TLS 1.3 cipher suites
274
275 `aes_128_gcm_sha_256`
276 `aes_256_gcm_sha_384`
277 `chacha20_poly1305_sha_256`
278
279 ## GSKit
280
281 Ciphers are internally defined as
282 [numeric codes](https://www.ibm.com/support/knowledgecenter/ssw_ibm_i_73/apis/gsk_attribute_set_buffer.htm),
283 but libcurl maps them to the following case-insensitive names.
284
285 ### SSL2 cipher suites (insecure: disabled by default)
286
287 `rc2-md5`
288 `rc4-md5`
289 `exp-rc2-md5`
290 `exp-rc4-md5`
291 `des-cbc-md5`
292 `des-cbc3-md5`
293
294 ### SSL3 cipher suites
295
296 `null-md5`
297 `null-sha`
298 `rc4-md5`
299 `rc4-sha`
300 `exp-rc2-cbc-md5`
301 `exp-rc4-md5`
302 `exp-des-cbc-sha`
303 `des-cbc3-sha`
304
305 ### TLS v1.0 cipher suites
306
307 `null-md5`
308 `null-sha`
309 `rc4-md5`
310 `rc4-sha`
311 `exp-rc2-cbc-md5`
312 `exp-rc4-md5`
313 `exp-des-cbc-sha`
314 `des-cbc3-sha`
315 `aes128-sha`
316 `aes256-sha`
317
318 ### TLS v1.1 cipher suites
319
320 `null-md5`
321 `null-sha`
322 `rc4-md5`
323 `rc4-sha`
324 `exp-des-cbc-sha`
325 `des-cbc3-sha`
326 `aes128-sha`
327 `aes256-sha`
328
329 ### TLS v1.2 cipher suites
330
331 `null-md5`
332 `null-sha`
333 `null-sha256`
334 `rc4-md5`
335 `rc4-sha`
336 `des-cbc3-sha`
337 `aes128-sha`
338 `aes256-sha`
339 `aes128-sha256`
340 `aes256-sha256`
341 `aes128-gcm-sha256`
342 `aes256-gcm-sha384`
343
344 ## WolfSSL
345
346 `RC4-SHA`,
347 `RC4-MD5`,
348 `DES-CBC3-SHA`,
349 `AES128-SHA`,
350 `AES256-SHA`,
351 `NULL-SHA`,
352 `NULL-SHA256`,
353 `DHE-RSA-AES128-SHA`,
354 `DHE-RSA-AES256-SHA`,
355 `DHE-PSK-AES256-GCM-SHA384`,
356 `DHE-PSK-AES128-GCM-SHA256`,
357 `PSK-AES256-GCM-SHA384`,
358 `PSK-AES128-GCM-SHA256`,
359 `DHE-PSK-AES256-CBC-SHA384`,
360 `DHE-PSK-AES128-CBC-SHA256`,
361 `PSK-AES256-CBC-SHA384`,
362 `PSK-AES128-CBC-SHA256`,
363 `PSK-AES128-CBC-SHA`,
364 `PSK-AES256-CBC-SHA`,
365 `DHE-PSK-AES128-CCM`,
366 `DHE-PSK-AES256-CCM`,
367 `PSK-AES128-CCM`,
368 `PSK-AES256-CCM`,
369 `PSK-AES128-CCM-8`,
370 `PSK-AES256-CCM-8`,
371 `DHE-PSK-NULL-SHA384`,
372 `DHE-PSK-NULL-SHA256`,
373 `PSK-NULL-SHA384`,
374 `PSK-NULL-SHA256`,
375 `PSK-NULL-SHA`,
376 `HC128-MD5`,
377 `HC128-SHA`,
378 `HC128-B2B256`,
379 `AES128-B2B256`,
380 `AES256-B2B256`,
381 `RABBIT-SHA`,
382 `NTRU-RC4-SHA`,
383 `NTRU-DES-CBC3-SHA`,
384 `NTRU-AES128-SHA`,
385 `NTRU-AES256-SHA`,
386 `AES128-CCM-8`,
387 `AES256-CCM-8`,
388 `ECDHE-ECDSA-AES128-CCM`,
389 `ECDHE-ECDSA-AES128-CCM-8`,
390 `ECDHE-ECDSA-AES256-CCM-8`,
391 `ECDHE-RSA-AES128-SHA`,
392 `ECDHE-RSA-AES256-SHA`,
393 `ECDHE-ECDSA-AES128-SHA`,
394 `ECDHE-ECDSA-AES256-SHA`,
395 `ECDHE-RSA-RC4-SHA`,
396 `ECDHE-RSA-DES-CBC3-SHA`,
397 `ECDHE-ECDSA-RC4-SHA`,
398 `ECDHE-ECDSA-DES-CBC3-SHA`,
399 `AES128-SHA256`,
400 `AES256-SHA256`,
401 `DHE-RSA-AES128-SHA256`,
402 `DHE-RSA-AES256-SHA256`,
403 `ECDH-RSA-AES128-SHA`,
404 `ECDH-RSA-AES256-SHA`,
405 `ECDH-ECDSA-AES128-SHA`,
406 `ECDH-ECDSA-AES256-SHA`,
407 `ECDH-RSA-RC4-SHA`,
408 `ECDH-RSA-DES-CBC3-SHA`,
409 `ECDH-ECDSA-RC4-SHA`,
410 `ECDH-ECDSA-DES-CBC3-SHA`,
411 `AES128-GCM-SHA256`,
412 `AES256-GCM-SHA384`,
413 `DHE-RSA-AES128-GCM-SHA256`,
414 `DHE-RSA-AES256-GCM-SHA384`,
415 `ECDHE-RSA-AES128-GCM-SHA256`,
416 `ECDHE-RSA-AES256-GCM-SHA384`,
417 `ECDHE-ECDSA-AES128-GCM-SHA256`,
418 `ECDHE-ECDSA-AES256-GCM-SHA384`,
419 `ECDH-RSA-AES128-GCM-SHA256`,
420 `ECDH-RSA-AES256-GCM-SHA384`,
421 `ECDH-ECDSA-AES128-GCM-SHA256`,
422 `ECDH-ECDSA-AES256-GCM-SHA384`,
423 `CAMELLIA128-SHA`,
424 `DHE-RSA-CAMELLIA128-SHA`,
425 `CAMELLIA256-SHA`,
426 `DHE-RSA-CAMELLIA256-SHA`,
427 `CAMELLIA128-SHA256`,
428 `DHE-RSA-CAMELLIA128-SHA256`,
429 `CAMELLIA256-SHA256`,
430 `DHE-RSA-CAMELLIA256-SHA256`,
431 `ECDHE-RSA-AES128-SHA256`,
432 `ECDHE-ECDSA-AES128-SHA256`,
433 `ECDH-RSA-AES128-SHA256`,
434 `ECDH-ECDSA-AES128-SHA256`,
435 `ECDHE-RSA-AES256-SHA384`,
436 `ECDHE-ECDSA-AES256-SHA384`,
437 `ECDH-RSA-AES256-SHA384`,
438 `ECDH-ECDSA-AES256-SHA384`,
439 `ECDHE-RSA-CHACHA20-POLY1305`,
440 `ECDHE-ECDSA-CHACHA20-POLY1305`,
441 `DHE-RSA-CHACHA20-POLY1305`,
442 `ECDHE-RSA-CHACHA20-POLY1305-OLD`,
443 `ECDHE-ECDSA-CHACHA20-POLY1305-OLD`,
444 `DHE-RSA-CHACHA20-POLY1305-OLD`,
445 `ADH-AES128-SHA`,
446 `QSH`,
447 `RENEGOTIATION-INFO`,
448 `IDEA-CBC-SHA`,
449 `ECDHE-ECDSA-NULL-SHA`,
450 `ECDHE-PSK-NULL-SHA256`,
451 `ECDHE-PSK-AES128-CBC-SHA256`,
452 `PSK-CHACHA20-POLY1305`,
453 `ECDHE-PSK-CHACHA20-POLY1305`,
454 `DHE-PSK-CHACHA20-POLY1305`,
455 `EDH-RSA-DES-CBC3-SHA`,
456
457 ## Schannel
458
459 Schannel allows the enabling and disabling of encryption algorithms, but not
460 specific ciphersuites. They are
461 [defined](https://docs.microsoft.com/windows/desktop/SecCrypto/alg-id) by
462 Microsoft.
463
464 There is also the case that the selected algorithm is not supported by the
465 protocol or does not match the ciphers offered by the server during the SSL
466 negotiation. In this case curl will return error
467 `CURLE_SSL_CONNECT_ERROR (35) SEC_E_ALGORITHM_MISMATCH`
468 and the request will fail.
469
470 `CALG_MD2`,
471 `CALG_MD4`,
472 `CALG_MD5`,
473 `CALG_SHA`,
474 `CALG_SHA1`,
475 `CALG_MAC`,
476 `CALG_RSA_SIGN`,
477 `CALG_DSS_SIGN`,
478 `CALG_NO_SIGN`,
479 `CALG_RSA_KEYX`,
480 `CALG_DES`,
481 `CALG_3DES_112`,
482 `CALG_3DES`,
483 `CALG_DESX`,
484 `CALG_RC2`,
485 `CALG_RC4`,
486 `CALG_SEAL`,
487 `CALG_DH_SF`,
488 `CALG_DH_EPHEM`,
489 `CALG_AGREEDKEY_ANY`,
490 `CALG_HUGHES_MD5`,
491 `CALG_SKIPJACK`,
492 `CALG_TEK`,
493 `CALG_CYLINK_MEK`,
494 `CALG_SSL3_SHAMD5`,
495 `CALG_SSL3_MASTER`,
496 `CALG_SCHANNEL_MASTER_HASH`,
497 `CALG_SCHANNEL_MAC_KEY`,
498 `CALG_SCHANNEL_ENC_KEY`,
499 `CALG_PCT1_MASTER`,
500 `CALG_SSL2_MASTER`,
501 `CALG_TLS1_MASTER`,
502 `CALG_RC5`,
503 `CALG_HMAC`,
504 `CALG_TLS1PRF`,
505 `CALG_HASH_REPLACE_OWF`,
506 `CALG_AES_128`,
507 `CALG_AES_192`,
508 `CALG_AES_256`,
509 `CALG_AES`,
510 `CALG_SHA_256`,
511 `CALG_SHA_384`,
512 `CALG_SHA_512`,
513 `CALG_ECDH`,
514 `CALG_ECMQV`,
515 `CALG_ECDSA`,
516 `CALG_ECDH_EPHEM`,