title: How does one set SSL ciphers when using CFSocket/CFStream in Cocoa?
body: <p>I recently needed to configure <a href="http://code.google.com/p/cocoahttpserver/" rel="nofollow noreferrer">CocoaHttpServer</a>, which we're using in our application with success, to handle HTTPS connections coming from a client application (running on Android devices). This is fine - there is copious sample code which allows for this, and we were able to enable the secure server without issue.</p>
  
  <p>In practice we were seeing incredibly long SSL negotiation phases while the client was doing its handshaking with our server - upwards of 70 seconds.</p>
  
  <p>Through a long series of searches, I found that the delay was because of the calculation of Diffie-Hellman parameters used by default when SSL is enabled in CFSocket. This <a href="http://lists.apple.com/archives/Apple-cdsa/2008/Oct/msg00004.html" rel="nofollow noreferrer">thread</a> is where I first started to find the answer to my issue.</p>
  
  <p>To match what our Windows server was doing (using a less-secure SSL cipher) I needed to set the cipher explicitly on the Mac, which isn't easy when using AsyncSocket as a wrapper for the socket communications.</p>
  
  <p>Our Windows server was using:
  TLS_RSA_WITH_RC4_128_MD5 )(0x04)
  RC4 128 bits MD5 RSA</p>
  
  <p>Our Macintosh server was using:
  TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x039)
  AES 256 bits SHA-1 Ephemeral Diffie-Hellman key exchange using RSA certificate</p>
  
  <p>The difference in "security" is large, but likely not worth the effort/computation/delay that we were seeing. Security Theater?</p>