On Tuesday 16 December 2014 04:53:11 Viktor Dukhovni wrote: > On Tue, Dec 16, 2014 at 04:23:24AM +0100, Hanno B?ck wrote: > > > On Tue, Dec 16, 2014 at 02:18:40AM +0100, Hanno B?ck wrote: > > > > Firefox and Chrome support authenticated encryption via TLS 1.2 and > > > > GCM these days. However they have for some reason decided not to > > > > support AES-256 but only AES-128. > > > > > > In which case, they will never use AES-256, and yet: > > No, you understood that wrong: They decided to not support AES-256 for > > CGM. For CBC they support both 128/256. > > In that case indeed many servers will choose CBC at 256 bits over > GCM at 128. This is a browser configuration issue, and should be > addressed there. > (...) > > The browsers need to fix their settings, but there are many competing > factors here, and perhaps they have good reasons for the choices > they made.
No, this is problem with OpenSSL cipher order - it prefers key size over other factors - it should prefer AEAD and PFS ciphers before ordering on key size, doubly so that in practice you can't get anywhere near 256 bit level of security using TLS. we've talked about this before preferring AES-256 over AES-128 in Internet setting with Internet CAs just burns cycles for nought also, the reason why neither Firefox nor Chrome support AES-256-GCM is because NSS doesn't support SHA-384 PFS for TLSv1.2 - it's not a case of "just flipping a switch" -- Regards, Hubert Kario _______________________________________________ openssl-dev mailing list openssl-dev@openssl.org https://mta.opensslfoundation.net/mailman/listinfo/openssl-dev