SHA-384 support
Alexander Ray
I'm rather excited that Chrome 29 brings official support for TLS 1.2 that is on-by-default, unlike Mozilla Firefox which requires tweaks that are... difficult for the average user, and IE which is slightly easier but still not enabled by default.
I do notice that Chrome 29 (and 30, which I have installed the beta of) supports SHA2, but apparently only the 256-bit variety. On the other hand, wireshark shows me that IE 10 (with tls 1.2 enabled) negotiates an ECDHE-RSA-AES256-CBC-SHA384 cipher suite, whereas Chrome gives AES128-CBC-SHA256.
Does anyone know if Chrome has implemented or will implement AES256-CBC-SHA384 as an option, and if so, which version it will be in? Has NSS even gotten there yet?
Chris Bentzel
> --
> Chromium Discussion mailing list: chromium...@chromium.org
> View archives, change email options, or unsubscribe:
> http://groups.google.com/a/chromium.org/group/chromium-discuss
>
Sverre Moe
No response for 9 months... Not good. Hope som Chromium developers read this.
Using AES GCM mode only 128-bit is available with SHA1 and SHA256.
Using AES CBC mode both 128-bit and 256-bit cipher is available, with SHA1 and SHA256.
What Chromium needs is AES GCM mode 256-bit and support for SHA384.
Chromium is not alone in this. Neither Firefox nor Opera supports this. I have found that Rekonq and Konqueror supports these higher cipher suites.
https://www.ssllabs.com/ssltest/viewMyClient.html
Cipher Suites (in order of preference)
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b) Forward Secrecy 128
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f) Forward Secrecy 128
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (0x9e) Forward Secrecy 128
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (0xc00a) Forward Secrecy 256
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (0xc009) Forward Secrecy 128
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013) Forward Secrecy 128
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014) Forward Secrecy 256
TLS_ECDHE_ECDSA_WITH_RC4_128_SHA (0xc007) Forward Secrecy 128
TLS_ECDHE_RSA_WITH_RC4_128_SHA (0xc011) Forward Secrecy 128
TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x33) Forward Secrecy 128
TLS_DHE_DSS_WITH_AES_128_CBC_SHA (0x32) Forward Secrecy* 128
TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x39) Forward Secrecy 256
TLS_RSA_WITH_AES_128_GCM_SHA256 (0x9c) 128
TLS_RSA_WITH_AES_128_CBC_SHA (0x2f) 128
TLS_RSA_WITH_AES_256_CBC_SHA (0x35) 256
TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) 112
TLS_RSA_WITH_RC4_128_SHA (0x5) 128
TLS_RSA_WITH_RC4_128_MD5 (0x4) 128
(*) Cannot be used for Forward Secrecy because they require DSS keys, which are effectively limited to 1024 bits.
Would be great if one could disable the weak ciphers in Chromium along with the old SSL/TLS versions to get a better grade on the ssltest.
