crypto/tls: add support for additional TLS ciphers

[shlormz]

I'm working on a project that requires connecting to a myriad of servers running a wide variety of software using HTTPS. Because I have no real influence over their configuration, I'm forced to use the ciphers they allow. There's a few that aren't included in Go, and I'm curious as to why or if you're open to supporting them:

TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
TLS_RSA_WITH_AES_256_CBC_SHA256

I've found a few other issues mentioning not using CBC where it can be avoided, but it can't in this case. Is there a reason these wouldn't be supported, but the same variants with other SHA versions would? For example, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 isn't defined, but TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA is. All three of those are like this, where just the SHA version is different and not necessarily better.

Thanks!

[dgryski]

/cc @FiloSottile

[odeke-em]

/cc @agl @titanous too

[FiloSottile]

crypto/tls aims to support a limited safe subset of TLS, such that most use cases are supported, but it's not intended to be compatible with all possible configurations.

CBC modes are extremely hard to implement securely due to their flawed MtE design, so we only retain the existing ones for legacy compatibility, and won't be adding any new ones.

Moreover, the SHA-1 implementation had to be modified to be usable securely with CBC modes, so other hashes are not trivial to add.