Re: h2 ciphers

[Julien Vehent <[e-mail]>]

On 2015-10-16 09:08, Amos Jeffries wrote:
> HTTP/2 was designed to be implemented from a clean-slate situation.
> Everybody is building new code based on the same spec, so there is no
> legacy behaviours to be tolerant about.

(I'm the author of the Mozilla guidelines).

This is correct: the recommendation is for HTTP/1.1 where a significant 
amount of backward compatibility is required. The modern guidelines 
guarantee strong crypto on somewhat recent clients, but we can certainly 
do better for http/2.

We'll probably revise the guidelines in the coming months. In the 
meantime, on a h2 endpoint, I would recommend limiting it to these 
ciphers:

$ openssl ciphers -V 
'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384'
0xC0,0x2F  -  ECDHE-RSA-AES128-GCM-SHA256    TLSv1.2  Kx=ECDH  Au=RSA    
Enc=AESGCM(128)  Mac=AEAD
0xC0,0x2B  -  ECDHE-ECDSA-AES128-GCM-SHA256  TLSv1.2  Kx=ECDH  Au=ECDSA  
Enc=AESGCM(128)  Mac=AEAD
0xC0,0x30  -  ECDHE-RSA-AES256-GCM-SHA384    TLSv1.2  Kx=ECDH  Au=RSA    
Enc=AESGCM(256)  Mac=AEAD
0xC0,0x2C  -  ECDHE-ECDSA-AES256-GCM-SHA384  TLSv1.2  Kx=ECDH  Au=ECDSA  
Enc=AESGCM(256)  Mac=AEAD

Note: we don't recommend ECDHE-RSA-CHACHA20-POLY1305 because it's not 
yet a standard and our mozilla servers don't implement it, but feel free 
to use it :)

- Julien