Bug 214915 – [Curl][WinCairo] Remove deprecated cipher suites.

• Status: RESOLVED
• Resolution: FIXED
• Component: Platform

[Takashi Komori]

In WinCairo port some deprecated cipher suites are enabled.
We remove those cipher suites and enable stronger algorithms, for reducing handshake time.

[Takashi Komori]

Created attachment 405537 [details]
Patch

[Basuke Suzuki]

Looks good to me.

If possible, can you point the default set of ciphers libcurl uses? It is not clear which cipher suites are removed.

[Takashi Komori]

(In reply to Basuke Suzuki from comment #2)
> Looks good to me.
> 
> If possible, can you point the default set of ciphers libcurl uses? It is
> not clear which cipher suites are removed.

In WinCairo port cipher suites below are enabled.

AES_128_GCM_SHA256
CHACHA20_POLY1305_SHA256
AES_256_GCM_SHA384
ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
ECDHE_RSA_WITH_AES_128_GCM_SHA256
ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
ECDHE_RSA_WITH_AES_256_GCM_SHA384
ECDHE_ECDSA_WITH_AES_256_CBC_SHA
ECDHE_ECDSA_WITH_AES_128_CBC_SHA
ECDHE_RSA_WITH_AES_128_CBC_SHA
ECDHE_RSA_WITH_AES_256_CBC_SHA
DHE_RSA_WITH_AES_128_CBC_SHA
DHE_RSA_WITH_AES_256_CBC_SHA
RSA_WITH_AES_128_CBC_SHA
RSA_WITH_AES_256_CBC_SHA
RSA_WITH_3DES_EDE_CBC_SHA

[Takashi Komori]

Cipher suites below are disabled.

RSA_WITH_RC4_128_MD5
RSA_WITH_RC4_128_SHA
DHE_RSA_WITH_3DES_EDE_CBC_SHA
RSA_WITH_AES_128_CBC_SHA256
RSA_WITH_AES_256_CBC_SHA256
RSA_WITH_CAMELLIA_128_CBC_SHA
DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
DHE_RSA_WITH_AES_128_CBC_SHA256
DHE_RSA_WITH_AES_256_CBC_SHA256
GOSTR341001_WITH_28147_CNT_IMIT
RSA_WITH_CAMELLIA_256_CBC_SHA
DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
DHE_RSA_WITH_AES_128_GCM_SHA256
RSA_WITH_AES_128_GCM_SHA256
RSA_WITH_AES_256_GCM_SHA384
DHE_RSA_WITH_AES_256_GCM_SHA384
RSA_WITH_CAMELLIA_128_CBC_SHA256
DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
RSA_WITH_CAMELLIA_256_CBC_SHA256
DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256
ECDHE_ECDSA_WITH_RC4_128_SHA
ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
ECDHE_RSA_WITH_RC4_128_SHA
ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
ECDHE_RSA_WITH_AES_128_CBC_SHA256
ECDHE_RSA_WITH_AES_256_CBC_SHA384
DHE_RAS_WITH_CHACHA20_POLY1305_SHA256

[Takashi Komori]

Default cipher suites for curl before applying the patch are suites summed up　enabled and disabled.

[Fujii Hironori]

Comment on attachment 405537 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=405537&action=review

> Tools/ChangeLog:11
> +        For testing enabled/diabled ciphers we added HTTPServer.cpp which uses TCPServer.cpp

Bug 215379 is going to land HTTPServer as a separate patch. Let's redo this patch after Bug 215379.

[Kenji Shukuwa]

Pull request: https://github.com/WebKit/WebKit/pull/6582

[EWS]

Committed 256775@main (597ffc8de927): <https://commits.webkit.org/256775@main>

Reviewed commits have been landed. Closing PR #6582 and removing active labels.

[Radar WebKit Bug Importer]

<rdar://problem/102455626>