1 TLS numbers used in various places
2 Pasi Eronen <pasi.eronen@nokia.com>
3 Last updated: November 18, 2005
5 NOTE: This is a totally unofficial list. The IANA registries
6 for TLS can be found at the following addresses:
8 http://www.iana.org/assignments/tls-parameters
9 http://www.iana.org/assignments/tls-extensiontype-values
12 TLS CLIENT CERTIFICATE TYPES
13 ============================
17 3 rsa_fixed_dh [RFC2246]
18 4 dss_fixed_dh [RFC2246]
19 5 rsa_ephemeral_dh_RESERVED [2246bis] [ssl3] [*16]
20 6 dss_ephemeral_dh_RESERVED [2246bis] [ssl3] [*15]
24 20 fortezza_dms_RESERVED [2246bis] [ssl3]
32 TLS CIPHERSUITE NUMBERS
33 =======================
35 00,00 TLS_NULL_WITH_NULL_NULL [RFC2246]
36 00,01 TLS_RSA_WITH_NULL_MD5 [RFC2246]
37 00,02 TLS_RSA_WITH_NULL_SHA [RFC2246]
38 00,03 TLS_RSA_EXPORT_WITH_RC4_40_MD5 [RFC2246]
39 00,04 TLS_RSA_WITH_RC4_128_MD5 [RFC2246]
40 00,05 TLS_RSA_WITH_RC4_128_SHA [RFC2246]
41 00,06 TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 [RFC2246]
42 00,07 TLS_RSA_WITH_IDEA_CBC_SHA [RFC2246]
43 00,08 TLS_RSA_EXPORT_WITH_DES40_CBC_SHA [RFC2246]
44 00,09 TLS_RSA_WITH_DES_CBC_SHA [RFC2246]
45 00,0A TLS_RSA_WITH_3DES_EDE_CBC_SHA [RFC2246]
46 00,0B TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA [RFC2246]
47 00,0C TLS_DH_DSS_WITH_DES_CBC_SHA [RFC2246]
48 00,0D TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA [RFC2246]
49 00,0E TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA [RFC2246]
50 00,0F TLS_DH_RSA_WITH_DES_CBC_SHA [RFC2246]
51 00,10 TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA [RFC2246]
52 00,11 TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA [RFC2246]
53 00,12 TLS_DHE_DSS_WITH_DES_CBC_SHA [RFC2246]
54 00,13 TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA [RFC2246]
55 00,14 TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA [RFC2246]
56 00,15 TLS_DHE_RSA_WITH_DES_CBC_SHA [RFC2246]
57 00,16 TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA [RFC2246]
58 00,17 TLS_DH_anon_EXPORT_WITH_RC4_40_MD5 [RFC2246]
59 00,18 TLS_DH_anon_WITH_RC4_128_MD5 [RFC2246]
60 00,19 TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA [RFC2246]
61 00,1A TLS_DH_anon_WITH_DES_CBC_SHA [RFC2246]
62 00,1B TLS_DH_anon_WITH_3DES_EDE_CBC_SHA [RFC2246]
63 00,1C (permanently reserved) [2246bis] [ssl3]
64 00,1D (permanently reserved) [2246bis] [ssl3]
65 00,1E TLS_KRB5_WITH_DES_CBC_SHA [RFC2712] [*1]
66 00,1F TLS_KRB5_WITH_3DES_EDE_CBC_SHA [RFC2712]
67 00,20 TLS_KRB5_WITH_RC4_128_SHA [RFC2712]
68 00,21 TLS_KRB5_WITH_IDEA_CBC_SHA [RFC2712]
69 00,22 TLS_KRB5_WITH_DES_CBC_MD5 [RFC2712]
70 00,23 TLS_KRB5_WITH_3DES_EDE_CBC_MD5 [RFC2712]
71 00,24 TLS_KRB5_WITH_RC4_128_MD5 [RFC2712]
72 00,25 TLS_KRB5_WITH_IDEA_CBC_MD5 [RFC2712]
73 00,26 TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA [RFC2712]
74 00,27 TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA [RFC2712]
75 00,28 TLS_KRB5_EXPORT_WITH_RC4_40_SHA [RFC2712]
76 00,29 TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5 [RFC2712]
77 00,2A TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5 [RFC2712]
78 00,2B TLS_KRB5_EXPORT_WITH_RC4_40_MD5 [RFC2712]
82 00,2F TLS_RSA_WITH_AES_128_CBC_SHA [RFC3268]
83 00,30 TLS_DH_DSS_WITH_AES_128_CBC_SHA [RFC3268]
84 00,31 TLS_DH_RSA_WITH_AES_128_CBC_SHA [RFC3268]
85 00,32 TLS_DHE_DSS_WITH_AES_128_CBC_SHA [RFC3268]
86 00,33 TLS_DHE_RSA_WITH_AES_128_CBC_SHA [RFC3268]
87 00,34 TLS_DH_anon_WITH_AES_128_CBC_SHA [RFC3268]
88 00,35 TLS_RSA_WITH_AES_256_CBC_SHA [RFC3268]
89 00,36 TLS_DH_DSS_WITH_AES_256_CBC_SHA [RFC3268]
90 00,37 TLS_DH_RSA_WITH_AES_256_CBC_SHA [RFC3268]
91 00,38 TLS_DHE_DSS_WITH_AES_256_CBC_SHA [RFC3268]
92 00,39 TLS_DHE_RSA_WITH_AES_256_CBC_SHA [RFC3268]
93 00,3A TLS_DH_anon_WITH_AES_256_CBC_SHA [RFC3268]
100 00,41 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA [RFC4132]
101 00,42 TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA [RFC4132]
102 00,43 TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA [RFC4132]
103 00,44 TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA [RFC4132]
104 00,45 TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA [RFC4132]
105 00,46 TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA [RFC4132]
115 00,50 (reserved for ongoing work) [srp-10] [*2]
116 00,51 (reserved for ongoing work) [srp-10] [*2]
117 00,52 (reserved for ongoing work) [srp-10] [*2]
118 00,53 (reserved for ongoing work) [srp-10] [*2]
119 00,54 (reserved for ongoing work) [srp-10] [*2]
120 00,55 (reserved for ongoing work) [srp-10] [*2]
121 00,56 (reserved for ongoing work) [srp-10] [*2]
122 00,57 (reserved for ongoing work) [srp-10] [*2]
123 00,58 (reserved for ongoing work) [srp-10] [*2]
131 00,60 TLS_RSA_EXPORT1024_WITH_RC4_56_MD5 [56bit] [*7]
132 00,61 TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 [56bit] [*7] [*12]
133 00,62 TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA [56bit] [*7] [*12]
134 00,63 TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA [56bit] [*7] [*12]
135 00,64 TLS_RSA_EXPORT1024_WITH_RC4_56_SHA [56bit] [*7] [*12]
136 00,65 TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA [56bit] [*7] [*12]
137 00,66 TLS_DHE_DSS_WITH_RC4_128_SHA [56bit] [*12]
149 00,72 (reserved for ongoing work) [openpgp-06] [*16]
150 00,73 (reserved for ongoing work) [openpgp-06] [*16]
151 00,74 (reserved for ongoing work) [openpgp-06] [*16]
154 00,77 (reserved for ongoing work) [openpgp-06] [*2] [*16]
155 00,78 (reserved for ongoing work) [openpgp-06] [*2] [*16]
156 00,79 (reserved for ongoing work) [openpgp-06] [*16]
159 00,7C (reserved for ongoing work) [openpgp-06]
160 00,7D (reserved for ongoing work) [openpgp-06]
161 00,7E (reserved for ongoing work) [openpgp-06]
163 00,80 (reserved for ongoing work) [cptls-02]
164 00,81 (reserved for ongoing work) [cptls-02]
165 00,82 (reserved for ongoing work) [cptls-02]
166 00,83 (reserved for ongoing work) [cptls-02]
167 00,84 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA [RFC4132]
168 00,85 TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA [RFC4132]
169 00,86 TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA [RFC4132]
170 00,87 TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA [RFC4132]
171 00,88 TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA [RFC4132]
172 00,89 TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA [RFC4132]
173 00,8A TLS_PSK_WITH_RC4_128_SHA [psk-09]
174 00,8B TLS_PSK_WITH_3DES_EDE_CBC_SHA [psk-09]
175 00,8C TLS_PSK_WITH_AES_128_CBC_SHA [psk-09]
176 00,8D TLS_PSK_WITH_AES_256_CBC_SHA [psk-09]
177 00,8E TLS_DHE_PSK_WITH_RC4_128_SHA [psk-09]
178 00,8F TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA [psk-09]
179 00,90 TLS_DHE_PSK_WITH_AES_128_CBC_SHA [psk-09]
180 00,91 TLS_DHE_PSK_WITH_AES_256_CBC_SHA [psk-09]
181 00,92 TLS_RSA_PSK_WITH_RC4_128_SHA [psk-09]
182 00,93 TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA [psk-09]
183 00,94 TLS_RSA_PSK_WITH_AES_128_CBC_SHA [psk-09]
184 00,95 TLS_RSA_PSK_WITH_AES_256_CBC_SHA [psk-09]
185 00,96 TLS_RSA_WITH_SEED_CBC_SHA [RFC4162]
186 00,97 TLS_DH_DSS_WITH_SEED_CBC_SHA [RFC4162]
187 00,98 TLS_DH_RSA_WITH_SEED_CBC_SHA [RFC4162]
188 00,99 TLS_DHE_DSS_WITH_SEED_CBC_SHA [RFC4162]
189 00,9A TLS_DHE_RSA_WITH_SEED_CBC_SHA [RFC4162]
190 00,9B TLS_DH_anon_WITH_SEED_CBC_SHA [RFC4162]
205 C0,00 (reserved for ongoing work) [ecc-12]
206 C0,01 (reserved for ongoing work) [ecc-12]
207 C0,02 (reserved for ongoing work) [ecc-12]
208 C0,03 (reserved for ongoing work) [ecc-12]
209 C0,04 (reserved for ongoing work) [ecc-12]
210 C0,05 (reserved for ongoing work) [ecc-12]
211 C0,06 (reserved for ongoing work) [ecc-12]
212 C0,07 (reserved for ongoing work) [ecc-12]
213 C0,08 (reserved for ongoing work) [ecc-12]
214 C0,09 (reserved for ongoing work) [ecc-12]
215 C0,0A (reserved for ongoing work) [ecc-12]
216 C0,0B (reserved for ongoing work) [ecc-12]
217 C0,0C (reserved for ongoing work) [ecc-12]
218 C0,0D (reserved for ongoing work) [ecc-12]
219 C0,0E (reserved for ongoing work) [ecc-12]
220 C0,0F (reserved for ongoing work) [ecc-12]
221 C0,10 (reserved for ongoing work) [ecc-12]
222 C0,11 (reserved for ongoing work) [ecc-12]
223 C0,12 (reserved for ongoing work) [ecc-12]
224 C0,13 (reserved for ongoing work) [ecc-12]
225 C0,14 (reserved for ongoing work) [ecc-12]
226 C0,15 (reserved for ongoing work) [ecc-12]
227 C0,16 (reserved for ongoing work) [ecc-12]
228 C0,17 (reserved for ongoing work) [ecc-12]
229 C0,18 (reserved for ongoing work) [ecc-12]
230 C0,19 (reserved for ongoing work) [ecc-12]
231 FE,FE (reserved) [fips]
232 FE,FF (reserved) [fips]
233 FF,E0 (reserved) [fips]
234 FF,E1 (reserved) [fips]
240 20 change_cipher_spec [RFC2246]
242 22 handshake [RFC2246]
243 23 application_data [RFC2246]
249 TLS ALERT DESCRIPTIONS
250 ======================
252 0 close_notify [RFC2246]
253 10 unexpected_message [RFC2246]
254 20 bad_record_mac [RFC2246]
255 21 decryption_failed [RFC2246]
256 22 record_overflow [RFC2246]
257 30 decompression_failure [RFC2246]
258 40 handshake_failure [RFC2246]
259 41 no_certificate_RESERVED [2246bis] [ssl3] [*13]
260 42 bad_certificate [RFC2246]
261 43 unsupported_certificate [RFC2246]
262 44 certificate_revoked [RFC2246]
263 45 certificate_expired [RFC2246]
264 46 certificate_unknown [RFC2246]
265 47 illegal_parameter [RFC2246]
266 48 unknown_ca [RFC2246]
267 49 access_denied [RFC2246]
268 50 decode_error [RFC2246]
269 51 decrypt_error [RFC2246]
270 60 export_restriction [RFC2246]
271 70 protocol_version [RFC2246]
272 71 insufficient_security [RFC2246]
273 80 internal_error [RFC2246]
274 90 user_canceled [RFC2246]
275 100 no_renegotiation [RFC2246]
276 110 unsupported_extension [RFC3546] [*13]
277 111 certificate_unobtainable [RFC3546] [*13]
278 112 unrecognized_name [RFC3546] [*13]
279 113 bad_certificate_status_response [RFC3546] [*13]
280 114 bad_certificate_hash_value [RFC3546]
281 115 unknown_psk_identity [psk-09]
292 0 hello_request [RFC2246]
293 1 client_hello [RFC2246]
294 2 server_hello [RFC2246]
295 3 hello_verify_request [dtls-05] [*5]
297 11 certificate [RFC2246]
298 12 server_key_exchange [RFC2246]
299 13 certificate_request [RFC2246]
300 14 server_hello_done [RFC2246]
301 15 certificate_verify [RFC2246]
302 16 client_key_exchange [RFC2246]
303 20 finished [RFC2246]
304 21 certificate_url [RFC3546]
305 22 certificate_status [RFC3546]
313 0 server_name [RFC3546]
314 1 max_fragment_length [RFC3546]
315 2 client_certificate_url [RFC3546]
316 3 trusted_ca_keys [RFC3546]
317 4 truncated_hmac [RFC3546]
318 5 status_request [RFC3546]
319 6 [srp-10] [*5] [*13] [*17]
320 7 [openpgp-06] [*5] [*17]
325 35 [ticket-05] [fast-00]
333 [ecc-12] Simon Blake-Wilson, Nelson Bolyard, Vipul Gupta, Chris
334 Hawk, and Bodo Moeller, "ECC Cipher Suites For TLS",
335 draft-ietf-tls-ecc-12, October 2005.
337 [openpgp-06] Nikos Mavroyanopoulos, "Using OpenPGP keys for TLS
338 authentication", draft-ietf-tls-openpgp-keys-06,
341 [srp-10] David Taylor, Tom Wu, Nikos Mavroyanopoulos, and
342 Trevor Perrin, "Using SRP for TLS Authentication",
343 draft-ietf-tls-srp-10, October 2005.
345 [psk-09] Pasi Eronen and Hannes Tschofenig, "Pre-Shared Key
346 Ciphersuites for Transport Layer Security (TLS)",
347 draft-ietf-tls-psk-09, June 2005.
349 [cptls-02] Grigorij Chudov and Serguei Leontiev, "GOST
350 Ciphersuites for Transport Layer Security",
351 draft-chudov-cryptopro-cptls-02, September 2005.
353 [express-01] Mohamad Badra, Ahmed Serhrouchni, and Pascal Urien,
354 "TLS Express", draft-badra-tls-express-01, February 2005.
356 [fast-00] Nancy Cam-Winget, David McGrew, Joseph Salowey, and
357 Hao Zhou, "EAP Flexible Authentication via Secure
358 Tunneling (EAP-FAST)", draft-cam-winget-eap-fast-00,
361 [ia-01] Paul Funk, Simon Blake-Wilson, Ned Smith, Hannes
362 Tschofenig, and Thomas Hardjono, "TLS Inner Application
363 Extension (TLS/IA)", draft-funk-tls-inner-application-
364 extension-01, February 2005.
366 [ssl3] Alan O. Freier, Philip Karlton, and Paul C. Kocher,
367 "The SSL Protocol Version 3.0", expired I-D
368 (draft-freier-ssl-version3-02.txt), November 1996.
370 [dtls-05] Eric Rescorla and Nagendra Modadugu, "Datagram
371 Transport Layer Security", draft-rescorla-dtls-05,
374 [sign-00] Ibrahim Hajjeh, Ahmed Serhrouchni, Mohamad Badra,
375 and Omar Cherkaoui, "TLS Sign",
376 draft-hajjeh-tls-sign-00, January 2005.
378 [prf-00] Grigorij Chudov, "Hash/PRF negotiation in TLS using
379 TLS extensions", draft-chudov-cryptopro-tlsprfneg-00,
382 [56bit] John Banes and Richard Harrington, "56-bit Export
383 Cipher Suites For TLS", expired Internet-Draft
384 draft-ietf-tls-56-bit-ciphersuites-01.txt, July
385 2001 (and version -00, January 1999). Although this
386 document was never published as RFC, these ciphersuites
387 are implemented by several vendors. Draft version -00
388 contains ciphersuites 0x60..63; version -01 includes
391 [fips] FIPS SSL CipherSuites, http://www.mozilla.org/projects/
392 security/pki/nss/ssl/fips-ssl-ciphersuites.html
394 [mtls-00] Mohamad Badra, Ibrahim Hajjeh, "TLS Multiplexing",
395 draft-badra-hajjeh-mtls-00, October 2005.
397 [*1] This number was previously used for
398 SSL_FORTEZZA_KEA_WITH_RC4_128_SHA in [ssl3]
400 [*2] Used by some OpenSSL development snapshots and
401 NSS 3.8/3.9, obsoleted by [ecc-12].
403 [*3] This number was used by an earlier version of [cptls-02],
404 but presumably this work has been superceded by [prf-00],
405 and the number can be reused for other purposes.
407 [*4] This number was used in draft-badra-tls-key-exchange-00
408 (Mohamad Badra, Omar Cherkaoui, Ibrahim Hajjeh, and
409 Ahmed Serhrouchni, "Pre-Shared-Key key Exchange
410 methods for TLS", August 2004), but presumably this
411 work has been superceded by [psk-09] and the number
412 can be reused for other purposes.
414 [*5] These numbers were used in
415 draft-shacham-tls-fast-track-00 (Hovav Shacham and Dan
416 Boneh, "TLS Fast-Track Session Establishment",
417 September 2001), but presumably this work is dead, and
418 the numbers can be used for other purposes.
420 [*6] These numbers were used in older versions of [ia-01].
422 [*7] These numbers were used by an older, obsolete
423 version of draft-lee-tls-seed (now RFC4162).
425 [*8] These numbers were used in draft-ietf-tls-seedhas-00
426 (Joo-won Jung and ChangHee Lee, "TLS Extension for SEED
427 and HAS-160", July 2000), but presumably this work is
428 dead, and the numbers can be used for other purposes.
430 [*9] This number was in draft-ietf-tls-delegation-01
431 (Keith Jackson, Steven Tuecke, and Doug Engert, "TLS
432 Delegation Protocol", February 2002), but presumably
433 this work is dead and the number can be reused for
436 [*10] These numbers were used in draft-ietf-tls-misty1-01
437 (Hidenori Ohta and Hirosato Tsuji, "Addition of MISTY1
438 to TLS", March 2001), but presumably this work is dead
439 and the numbers can be reused for other purposes.
441 [*11] These numbers were used in draft-ietf-tls-ntru-00 (Ari
442 Singer, "NTRU Cipher Suites for TLS", July 2001), but
443 presumably this work is dead and the numbers can be
444 reused for other purposes.
446 [*12] These numbers were used in draft-ietf-tls-ntru-00,
447 but presumably this work is dead, and and many of
448 the numbers are widely used for other purposes anyway.
450 [*13] These numbers were used in draft-ietf-tls-pathsec-00
451 (Joseph Hui, "TLS Pathsec Protocol", September 2001),
452 but presumably this work is dead, and the numbers
453 can be used for other purposes.
455 [*14] These numbers were used in draft-ietf-tls-openpgp-02
456 (Will Price and Michael Elkins, "Extensions to TLS for
457 OpenPGP keys", February 2002), but presumably this
458 work is dead, and the numbers can be used for other
461 [*15] These numbers were used in draft-madhu-tls-spki-00
462 (H. S. Madhusudhana and V. R. Ramachandran, "SPKI
463 Certificate Integration with Transport Layer Security
464 (TLS) for Client Authentication and Authorization",
465 July 2001), but presumably this work is dead, and the
466 numbers can be used for other purposes.
468 [*16] These numbers were used in draft-ietf-tls-kerb-01
469 (Matthew Hur, Joseph Salowey, and Ari Medvinsky,
470 "Kerberos Cipher Suites in Transport Layer Security
471 (TLS)", November 2001), but presumably this work is
472 dead, and the numbers can be used for other purposes.
474 [*17] These numbers were used in older versions of [ecc-12].