{"action":"opened","issue":{"url":"https://api.github.com/repos/mozilla/server-side-tls/issues/124","repository_url":"https://api.github.com/repos/mozilla/server-side-tls","labels_url":"https://api.github.com/repos/mozilla/server-side-tls/issues/124/labels{/name}","comments_url":"https://api.github.com/repos/mozilla/server-side-tls/issues/124/comments","events_url":"https://api.github.com/repos/mozilla/server-side-tls/issues/124/events","html_url":"https://github.com/mozilla/server-side-tls/issues/124","id":136657228,"number":124,"title":"TLS cipher suite ordering is... odd","user":{"login":"robmoss2k","id":15984835,"avatar_url":"https://avatars.githubusercontent.com/u/15984835?v=3","gravatar_id":"","url":"https://api.github.com/users/robmoss2k","html_url":"https://github.com/robmoss2k","followers_url":"https://api.github.com/users/robmoss2k/followers","following_url":"https://api.github.com/users/robmoss2k/following{/other_user}","gists_url":"https://api.github.com/users/robmoss2k/gists{/gist_id}","starred_url":"https://api.github.com/users/robmoss2k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/robmoss2k/subscriptions","organizations_url":"https://api.github.com/users/robmoss2k/orgs","repos_url":"https://api.github.com/users/robmoss2k/repos","events_url":"https://api.github.com/users/robmoss2k/events{/privacy}","received_events_url":"https://api.github.com/users/robmoss2k/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-02-26T10:31:15Z","updated_at":"2016-02-26T10:31:15Z","closed_at":null,"body":"The modern cipher suite configuration enforces ECDHE and prefers ECDSA over RSA. That's good. It prioritises AES256 GCM, then ChaChaPoly, then AES128 GCM, then AES256 CBC, then AES128 CBC. However, the greatest threat to any of the AEAD cipher suites is side-channel timing attacks, so the ordering is wrong. AES128 GCM and ChaChaPoly should be in an equivalence group (not widely supported, I know, but in reality either are OK to go first) ahead of AES256 GCM. AES256 CBC should still be prioritised over AES128 CBC, so that's OK. Again, with the greatest threat being side-channel timing attacks, the first priority should probably be ECDSA over RSA, but that's at least debatable. \r\n\r\nThe intermediate cipher suite configuration is where things start to get odd. It starts well, preferring ECDHE, preferring ECDSA over RSA, and preferring ChaChaPoly over AES128 GCM over AES256 GCM (curiously, different to the ordering in the modern cipher suite configuration, and this time correctly). Then it's the GCM suites, 128 then 256 over DHE. After that it gets silly, with no sensible pattern to the ordering: ECDHE-ECDSA-AES128-SHA256, ECDHE-RSA-AES128-SHA256, ECDHE-ECDSA-AES128-SHA, ECDHE-RSA-AES256-SHA384, ECDHE-RSA-AES128-SHA, ECDHE-ECDSA-AES256-SHA384, ECDHE-ECDSA-AES256-SHA, ECDHE-RSA-AES256-SHA. There's also a difference in ordering with the TLS_DHE_RSA suites and the corresponding TLS_RSA suites for AES128 and AES256.\r\n\r\nThe old cipher suite configuration is a bit mad as well. Why are there three DSS cipher suites in there, when DSS certificates don't even exist any more? Why is there a flipping between preferring ECDSA over RSA and then vice versa and back again many times? Why is a DSS suite preferred over anything else, if it even has to be there, due to the 1024-bit private key size limit?\r\n\r\nAll three configurations used to look a lot better and a lot more carefully considered than this before a script starting generating them, apparently incorrectly. I think the intended output should probably be:\r\n\r\n`Modern: ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256`\r\n\r\n`Intermediate: ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:AES128-SHA256:AES128-SHA:DES-CBC3-SHA:!DSS`\r\n\r\n`Old: ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:AES128-SHA256:AES128-SHA:AES:DES-CBC3-SHA:HIGH:SEED:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!RSAPSK:!aDH:!aECDH:!EDH-DSS-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA:!SRP`"}}