Popular libraries such as OpenSSL and GnuTLS support TLSv1.2 (NSA Suite B Crypto[1]). Typically this means preferring or forcing TLS_ECDHE_ECDSA_AES_256_GCM_SHA

Popular libraries such as OpenSSL and GnuTLS support TLSv1.2 (NSA Suite B Crypto[1]). Typically this means preferring or forcing TLS_ECDHE_ECDSA_AES_256_GCM_SHA384 with elliptic curve CURVE-SECP521R1 for maximum security. Refer to [2] for more information on the elliptic curve key sizes recommended to be used with various symmetric key sizes. The notable problem for many users (particularly client-side) is libraries such as NSS not yet supporting TLSv1.2[3] and therefore not supporting NSA Suite B Crypto. [1] https://en.wikipedia.org/wiki/NSA_Suite_B_Cryptography https://en.wikipedia.org/wiki/NSA_Suite_B_Cryptography [2] http://www.nsa.gov/business/programs/elliptic_curve.shtml http://www.nsa.gov/business/programs/elliptic_curve.shtml [3] Refer to https://en.wikipedia.org/wiki/Comparison_of_TLS_implementations https://en.wikipedia.org/wiki/Comparison_of_TLS_implementati... for a comparison of libraries providing TLS crypto.