Re: h2 ciphers

[Ilari Liusvaara <[e-mail]>]

On Fri, Oct 16, 2015 at 12:35:51PM +0200, Stefan Eissing wrote:
> In the documentation at https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility the "modern" compatibility specification includes the following ciphers:
> 
> ECDHE-RSA-AES128-SHA
> ECDHE-RSA-AES128-SHA256
> ECDHE-ECDSA-AES128-SHA
> ECDHE-ECDSA-AES128-SHA256
> 
> ECDHE-RSA-AES256-SHA
> ECDHE-RSA-AES256-SHA384
> ECDHE-ECDSA-AES256-SHA
> ECDHE-ECDSA-AES256-SHA384
> 
> DHE-RSA-AES128-SHA
> DHE-RSA-AES128-SHA256
> DHE-RSA-AES256-SHA
> DHE-RSA-AES256-SHA256
> DHE-DSS-AES256-SHA
> DHE-DSS-AES128-SHA256
> 
> but RFC 7540 includes TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (ECDHE-RSA-AES128-SHA) and all those others as a MAY for INADEQUATE_SECURITY.
> 
> Now, assuming I got the cipher names correct, what am I to check for? Shall I be liberal in what I accept - again?

AFAIK, that list is for HTTP/1.1. HTTP/2 has list of ciphers that
are not to be used.


And it is also unnecressarily wide. Just about everything that supports
"modern" in sense Mozilla TLS guide uses it supports:

- TLS 1.2
- ECDHE
- RSA and ECDSA
- At least one of AES-128-GCM, AES-256-GCM, AES-256-CBC.


(The AES-256-CBC cipher is for Apple products, as those only recently
gained GCM support).

Priorize AEAD ciphers over AES-256-CBC and ciphersuite selection for
h2 should go properly.


-Ilari