# TLS_RSA_WITH_IDEA_CBC_SHA cipher suite > TLS_RSA_WITH_IDEA_CBC_SHA (0x00,0x07): RSA/RSA · IDEA-CBC · SSL 3.0, TLS 1.0, TLS 1.1. ssl.sh rating: Insecure. OpenSSL/GnuTLS names and Nginx/Apache config. Source: https://ssl.sh/ciphers/tls-rsa-with-idea-cbc-sha/ Last updated: 2026-11-10 TLS_RSA_WITH_IDEA_CBC_SHA (0x00,0x07) is a cipher suite for SSL 3.0, TLS 1.0, TLS 1.1: RSA key exchange, RSA authentication, IDEA-CBC encryption and SHA1 message authentication. ssl.sh rates it Insecure. | Field | Value | |---|---| | IANA | TLS_RSA_WITH_IDEA_CBC_SHA | | Hex code | 0x00,0x07 | | OpenSSL | IDEA-CBC-SHA | | GnuTLS | - | | Key exchange | RSA | | Authentication | RSA | | Encryption | IDEA-CBC | | MAC | SHA1 | | TLS versions | SSL 3.0, TLS 1.0, TLS 1.1 | | Rating | Insecure | | IANA "Recommended" | D | | References | RFC 8996, RFC 10015 | ## What each component means A [cipher suite](https://ssl.sh/glossary/cipher-suite/) names the algorithms a client and server agree on in one handshake. TLS_RSA_WITH_IDEA_CBC_SHA combines RSA key exchange, RSA authentication, IDEA-CBC encryption and SHA1 integrity protection. Each part is explained below with its known weaknesses; for the bigger picture see [how cipher suites work](https://ssl.sh/learn/cipher-suites/). Key exchange: [RSA](https://ssl.sh/glossary/rsa/) key transport. The client picks the premaster secret, encrypts it with the public key in the server certificate (PKCS #1 v1.5 padding) and sends it. There is no ephemeral key, so the suite has no [forward secrecy](https://ssl.sh/glossary/forward-secrecy/): anyone who records the traffic and later obtains the server's private key can decrypt every past session. The padding is also the target of Bleichenbacher's 1998 chosen-ciphertext attack, and [ROBOT](https://ssl.sh/glossary/robot/) (2017) found that many production TLS stacks still leaked that padding oracle, letting an attacker decrypt sessions or sign with the server's key without ever holding it. Encryption: IDEA, a 1991 block cipher with a 128-bit key but only a 64-bit block. TLS 1.2 ([RFC 5246](https://www.rfc-editor.org/rfc/rfc5246)) dropped the IDEA and DES suites as deprecated, and the 64-bit block puts it in the same birthday-bound class as 3DES ([Sweet32](https://ssl.sh/glossary/sweet32/)). Mode: CBC with MAC-then-encrypt. TLS 1.2 and earlier compute the HMAC over the plaintext, then pad and encrypt, so a receiver has to decrypt before it can check integrity. That ordering produced a long run of padding-oracle attacks: [BEAST](https://ssl.sh/glossary/beast/) (CVE-2011-3389) against TLS 1.0's predictable IVs, Lucky Thirteen (CVE-2013-0169, 2013), which times the MAC check, and [POODLE](https://ssl.sh/glossary/poodle/) (CVE-2014-3566, 2014) against SSL 3.0's unchecked padding. [RFC 9325](https://www.rfc-editor.org/rfc/rfc9325) (2022) says CBC suites SHOULD NOT be used unless the encrypt_then_mac extension ([RFC 7366](https://www.rfc-editor.org/rfc/rfc7366)) is also negotiated. Integrity: HMAC-SHA1. [SHA-1](https://ssl.sh/glossary/sha-1/) collisions are practical (SHAttered, 2017), but HMAC does not rely on collision resistance, so HMAC-SHA1 record MACs are not considered broken; this suite's weak points lie elsewhere. ## Why this rating - Uses IDEA, a 64-bit block cipher that RFC 5246 removed from TLS 1.2. ## Which TLS libraries support it Support for TLS_RSA_WITH_IDEA_CBC_SHA as read from each library's own source code or official documentation on 2026-11-10. “Enabled by default” means the library negotiates it with no configuration; “off by default” means it is implemented but has to be switched on. | Library | Status | Details | |---|---|---| | OpenSSL 3.5 | Implemented | cipher string `IDEA-CBC-SHA`; listed in the OpenSSL 3.5 manual, not enabled in our test build | | GnuTLS | Not supported | - | | BoringSSL | Not supported | - | | Go crypto/tls | Not supported | - | | NSS 3.133 | Not supported | - | | Firefox | Not supported | - | | Java 21 (SunJSSE) | Not supported | - | | Windows Schannel (Windows 11 / Server 2022) | Not supported | - | | rustls 0.23.46 | Not supported | - | None of the 9 libraries tracked here enables it by default. Also implemented by: OpenSSL 3.5. NSS shows the library's own defaults; Firefox switches every NSS suite off at start-up and re-enables only those with a security.ssl3.* or security.tls13.* preference. Java defaults are derived from the jdk.tls.disabledAlgorithms value Oracle documents for JDK 21, which later updates may extend. The OpenSSL and GnuTLS rows only show whether the suite is implemented. - [BoringSSL — ssl/ssl_cipher.cc (main)](https://boringssl.googlesource.com/boringssl/+/refs/heads/main/ssl/ssl_cipher.cc) (2026-11-10) - [Go — src/crypto/tls/cipher_suites.go (master)](https://github.com/golang/go/blob/master/src/crypto/tls/cipher_suites.go) (2026-11-10) - [Go — src/crypto/tls/defaults.go (master)](https://github.com/golang/go/blob/master/src/crypto/tls/defaults.go) (2026-11-10) - [NSS — lib/ssl/ssl3con.c (as vendored in Firefox)](https://github.com/mozilla-firefox/firefox/blob/main/security/nss/lib/ssl/ssl3con.c) (2026-11-10) - [NSS — TAG-INFO](https://github.com/mozilla-firefox/firefox/blob/main/security/nss/TAG-INFO) (2026-11-10) - [Firefox — security/manager/ssl/nsNSSComponent.cpp](https://github.com/mozilla-firefox/firefox/blob/main/security/manager/ssl/nsNSSComponent.cpp) (2026-11-10) - [Firefox — modules/libpref/init/StaticPrefList.yaml](https://github.com/mozilla-firefox/firefox/blob/main/modules/libpref/init/StaticPrefList.yaml) (2026-11-10) - [Oracle — JDK 21 Providers Documentation: SunJSSE Cipher Suites](https://docs.oracle.com/en/java/javase/21/security/oracle-providers.html#GUID-7093246A-31A3-4304-AC5F-5FB6400405E2) (2026-11-10) - [Oracle — JDK 21 JSSE Reference Guide: jdk.tls.disabledAlgorithms](https://docs.oracle.com/en/java/javase/21/security/java-secure-socket-extension-jsse-reference-guide.html) (2026-11-10) - [Microsoft Learn — TLS Cipher Suites in Windows 11](https://learn.microsoft.com/en-us/windows/win32/secauthn/tls-cipher-suites-in-windows-11) (2026-11-10) - [Microsoft Learn — TLS Cipher Suites in Windows Server 2022](https://learn.microsoft.com/en-us/windows/win32/secauthn/tls-cipher-suites-in-windows-server-2022) (2026-11-10) - [docs.rs — rustls 0.23.46 crypto::aws_lc_rs (default provider)](https://docs.rs/rustls/0.23.46/src/rustls/crypto/aws_lc_rs/mod.rs.html) (2026-11-10) ## History and standards status The IANA registry entry for TLS_RSA_WITH_IDEA_CBC_SHA (0x00,0x07) now cites only [RFC 8996](https://www.rfc-editor.org/rfc/rfc8996), “Deprecating TLS 1.0 and TLS 1.1” (March 2021, Best Current Practice) and [RFC 10015](https://www.rfc-editor.org/rfc/rfc10015), “Deprecating Obsolete Key Exchange Methods in TLS 1.2 and DTLS 1.2” (July 2026, Standards Track). The TLS 1.2 specification, [RFC 5246](https://www.rfc-editor.org/rfc/rfc5246) (2008), removed the IDEA and DES suites, calling them deprecated. It can only be negotiated in SSL 3.0, TLS 1.0, TLS 1.1. [RFC 7568](https://www.rfc-editor.org/rfc/rfc7568) (2015) deprecated SSL 3.0 and [RFC 8996](https://www.rfc-editor.org/rfc/rfc8996) (2021) deprecated TLS 1.0 and TLS 1.1, so no protocol version still in good standing allows it. [RFC 10015](https://www.rfc-editor.org/rfc/rfc10015) (2026) now says clients MUST NOT offer and servers MUST NOT select RSA key-exchange suites in (D)TLS 1.2, and IANA changed this entry's Recommended value to D. ## Nginx / Apache Disable ```nginx ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:!IDEA-CBC-SHA'; ``` ```apache SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:!IDEA-CBC-SHA ``` ## How to test whether a server accepts it Offer only TLS_RSA_WITH_IDEA_CBC_SHA with openssl s_client; if the handshake completes, the server accepts it: ```bash openssl s_client -connect example.com:443 -tls1 -cipher IDEA-CBC-SHA