On Oct 5, 2013, at 9:02 AM, Daniel Stenberg <daniel_at_haxx.se> wrote:

> That's a very old OpenSSL version though. My OpenSSL/1.0.1e supports TLS 1.2 fine.

I know, but I was using Apple's OpenSSL for the test, and Apple's OpenSSL isn't going to get any newer. Apple wants everyone to switch to Secure Transport, which is difficult because there's a lot of stuff out there that depends on OpenSSL, including several important components of OS X (Apache, LDAP, Subversion, etc.).

>> Meanwhile, the OpenSSL back-end advertised support for a number of weak suites with only 40- and 56-bit keys. Shouldn't we be blocking those by default?
>
> We haven't really discussed this, but yes I think we should!

We definitely ought to:

1. Block insecure ciphers by default (like 40-bit and 56-bit ciphers, NULL and anonymous ciphers, IDEA, etc.)
2. If possible, prioritize ECDH over all, then CBC, then RC4, and then DH. (Except when TLS 1.0 is in use and the BEAST workaround is disabled, in which case RC4 should take precedence over CBC.)

The darwinssl code already does this, and it looks like schannel does as well. For OpenSSL, I suppose you could get the cipher list with SSL_get_cipher_list(), filter out the insecure ones, and then set the results using SSL_CTX_set_cipher_list() unless the user provided their own cipher list.

Nick Zitzmann
<http://www.chronosnet.com/>

-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-library
Etiquette: http://curl.haxx.se/mail/etiquette.html
Received on 2013-10-07