-
Notifications
You must be signed in to change notification settings - Fork 9.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Restrict HTTP/2 connections to AEAD ciphers only #959
Comments
The requirement is in flux. Summary so far seems either TLS 1.2 where !isBlock() && !isStream() or TLS 1.3 Let's hold off until next draft (15) before addressing this. |
|
Punting to 2.2. |
I'm not going to take further action here. We offer HTTP/2-capable ciphers, and HTTP/2 incapable ciphers. If the server incorrectly negotiates a non-HTTP/2 cipher suite and the HTTP/2 protocol, we'll do HTTP/2. This isn't perfect, but it's simple. |
(alternately we'd need to kill the socket and renegotiate TLS, disabling ALPN. I don't think it's worth the effort). |
Makes sense
|
HTTP/2 Draft 13 restricts TLS cipher suites, and requires support of [TLS-ECDHE] with P256 [FIPS186].
http://tools.ietf.org/html/draft-ietf-httpbis-http2-14#section-9.2.2
The text was updated successfully, but these errors were encountered: