NSS has removed some extremely crufty stuff, but most of the primitives are still in place.
You can still access MD2 or single-DES via the PKCS#11 interface if you need access to the raw primitives. For TLS, which I'm assuming is what you are interested in, we have removed SSL version 2, but we still have SSL version 3. It's disabled by default, but it can be enabled if you really need it. The same goes for a bunch of ciphersuites or primitives that are equally inadvisable. Many of these are now turned off by default, but if you need RC4, SHA-1, or single-DES in TLS, the code is mostly still there and accessible. To turn these on, take a look at: SSL_VersionRangeSet for TLS versions SSL_CipherPrefSet for cipher suites SSL_SignatureSchemePrefSet for signing algorithms SSL_NamedGroupConfig for key exchange algorithms For really old configurations, you might have to use all of these. If you have more specific requirements or questions, just ask. Finally, I'm assuming here that you have verified that a) you really need this stuff, b) you don't genuinely depend on these algorithms, and c) upgrading the other end is infeasible. Because when you do this, you aren't getting anything like what we would consider "security" by modern standards. On Wed, Dec 11, 2019 at 7:42 PM <[email protected]> wrote: > Hi > > For legacy reason customer wants to use old weak ciphers for internal > communication. > > So I want to know if NSS allow usage of old, deprecated or weak ciphers > > Did NSS removed any old ciphers ? > > Does NSS throw errors while connecting the server using old weak ciphers? > > How to enable old weak ciphers? > > Thanks > > Gajanan. > > > _______________________________________________ > dev-security mailing list > [email protected] > https://lists.mozilla.org/listinfo/dev-security > _______________________________________________ dev-security mailing list [email protected] https://lists.mozilla.org/listinfo/dev-security
