New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 664594 link

Starred by 2 users
Status: WontFix
Owner:
█ aber...@chromium.org
Last visit > 30 days ago
Closed: Dec 2016
Cc:
rsleevi@chromium.org
█ bauerb@chromium.org
█ aber...@chromium.org
█ lzia@google.com
Components:
EstimatedDays: ----
NextAction: 2016-11-14
OS: Android
Pri: 3
Type: Feature



Sign in to add a comment

Support NIAP-mode for compliant cipher suites and elliptic curves in Clank

Project Member Reported by lzia@google.com, Nov 11 2016 
Introduce support of 'NIAP mode', (a policy/restriction) that when NIAP-mode is enabled it will:

1-  Enforce that NIAP-compliant cipher suites only are supported (all other non-compliant cipher suites should be disabled in this mode). The following is the list of approved cipher suites at at https://www.niap-ccevs.org/pp/pp_md_v3.0.pdf (FC_TLSC_EXT.1.1) 
·         TLS_RSA_WITH_AES_128_CBC_SHA
·         TLS_RSA_WITH_AES_256_CBC_SHA
·         TLS_DHE_RSA_WITH_AES_128_CBC_SHA
·         TLS_DHE_RSA_WITH_AES_256_CBC_SHA
·         TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
·         TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
·         TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
·         TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
·         TLS_RSA_WITH_AES_128_CBC_SHA256
·         TLS_RSA_WITH_AES_256_CBC_SHA256
·         TLS_RSA_WITH_AES_256_GCM_SHA384
·         TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
·         TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
·         TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
·         TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
·         TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
·         TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384

2- Enforce that only NIAP-compliant elliptic curves are supported when in NIAP mode. Specifically, they would need to omit Curve25519 in NIAP mode.

Comment 1 by lzia@google.com, Nov 11 2016

Description: Show this description

Comment 2 by rsgav...@chromium.org, Nov 11 2016

Status: Assigned (was: Unconfirmed)

Comment 3 by bauerb@chromium.org, Nov 23 2016

Cc: aber...@chromium.org

Comment 4 by aber...@chromium.org, Nov 28 2016

Cc: bauerb@chromium.org
Owner: aber...@chromium.org

Comment 5 by aber...@chromium.org, Dec 19 2016

Status: WontFix (was: Assigned)
We will not be doing this. As discussed offline we believe that allowing this would introduce a security risk into Chrome, and doing this in Chrome alone might not satisfy the NIAP requirements (which are device based).

Comment 6 by bauerb@chromium.org, Jan 5 2017

Cc: rsleevi@chromium.org
Components: Internals>Network>SSL
With that being said, as it turns out there is already support for a command-line flag that allows blacklisting cipher suites, implemented by... Ryan :-D (see  issue 58831 ).
►

Sign in to add a comment