You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We already prioritize ChaCha20 if we lack AES hardware, as software AES implementations are slow and less secure, and on the client side that's the best we can do. On the server, though, that only applies if PreferServerCipherSuites is set, and it ignores the client preference.
When CipherSuites is nil, we should only pick AES if we have hardware support for it and the client communicated it prefers AES (implying they have hardware support). I think we should do this regardless of PreferServerCipherSuites if CipherSuites is nil, and regardless of CipherSuites if PreferServerCipherSuites is false: the only combination that expresses a strong application preference ordering is when they are both set.
This is why I didn't expose the default preference order! This logic can't be expressed as a static preference order.
The text was updated successfully, but these errors were encountered:
We already prioritize ChaCha20 if we lack AES hardware, as software AES implementations are slow and less secure, and on the client side that's the best we can do. On the server, though, that only applies if
PreferServerCipherSuites
is set, and it ignores the client preference.go/src/crypto/tls/common.go
Line 1418 in e6583dc
When
CipherSuites
is nil, we should only pick AES if we have hardware support for it and the client communicated it prefers AES (implying they have hardware support). I think we should do this regardless ofPreferServerCipherSuites
ifCipherSuites
is nil, and regardless ofCipherSuites
ifPreferServerCipherSuites
is false: the only combination that expresses a strong application preference ordering is when they are both set.This is why I didn't expose the default preference order! This logic can't be expressed as a static preference order.
The text was updated successfully, but these errors were encountered: