New issue
Advanced search Search tips

Issue 691888 link

Starred by 3 users

Issue metadata

Status: Untriaged
Owner: ----
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Feature



Sign in to add a comment

Make 3DES a fallback-only cipher

Reported by zzq1...@gmail.com, Feb 14 2017

Issue description

UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Steps to reproduce the problem:
1. Go to https://dev.ssllabs.com/ssltest/viewMyClient.html
2. Scroll down to see the Cipher Suites Section
3. There is TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa)

What is the expected behavior?
This cipher should not be there.

What went wrong?
https://sweet32.info/
3DES is weak and slow, and can be weaker as the time goes. 
However, some servers are strangely configured to prioritize 3DES over AES, make Chrome negotiates 3DES with those servers. 

Did this work before? No 

Chrome version: 56.0.2924.87  Channel: stable
OS Version: 
Flash Version: 

Treat 3DES the same way as RC4.
Remove DHE from the fallback cipher list and add 3DES. 
Also, in order to prevent future attacks with ciphers with 128-bit block sizes, please limit the data that is encrypted by the same key. 
https://bugzilla.mozilla.org/show_bug.cgi?id=1268745
 
Components: Internals>Network>SSL
Labels: -Type-Bug-Security -Restrict-View-SecurityTeam Type-Feature
This is effectively a security feature request, not a vulnerability report.

Comment 2 by och...@chromium.org, Feb 14 2017

Labels: -Type-Bug-Security -Restrict-View-SecurityTeam Type-Feature
Components: Internals>Network>SSL
Status: Untriaged (was: Unconfirmed)

Sign in to add a comment