Re: Improved TLS Defaults

Hi Daniel, Looking at the openssl output, this eliminates all weak ciphersuites. I'm testing using the Qualys service at: https://www.ssllabs.com/ssltest/viewMyClient.html I have two things to be considered on top of this: 1. If you check the ciphersuite order of the proposed ciphers vs cURL (current HEAD) vs Mozilla (https://wiki.mozilla.org/Security/Server_Side_TLS), the ciphers which support perfect forward secrecy are dispersed throughout the list for the RFC and cURL so numerous non-PRS ciphers will gain preference over PFS ciphers. PFS has become a big deal recently with people worried about companies having their private keys stolen or handed over on foot of a warrant by a three letter agency. I think we should take this opportunity to follow the trend and that's basically why Mozilla have such a long explicit ordering in their suite. 2. There has been some questions raised about the efficacy of stronger 256 ciphers vs 128 ciphers. The Mozilla list therefore reorders the ciphers to prefer the faster 128 ciphers while still maintaining the preference for PFS first. The base reference for this is: https://www.schneier.com/blog/archives/2009/07/new_attack_on_a.html. This describes an attack valid for AES256 but NOT for AES128. To be fair, the attack should be beyond anyone's computational resources at this time but as the old pessimist's view goes, if it breaks once, it'll probably break again, and again, ad infinitum. So if we were to be extremely cautious, preferring AES128 would be the ticket. Looking around, it's clear that choosing a cipher suite is not an easy task. Mozilla, IE and Chromium all differ. cURL and openssl also differ from the browsers. cURL recently amended its list away from the openssl DEFAULT on foot of a security report but I don't think they put sufficient thought into it and basically relied on openssl's judgement for the most part. In the absence of openssl amending DEFAULT (which may well happen at some point - it was reported to them afterall), I think Mozilla has the better approach. The other outcome of the Mozilla ciphersuite is that it removes all ciphers below 128 (there's about 15 or so below that waterline). These are not reported as weak on the Qualys site or howsmyssl.com, however, so not sure if it's necessary in our case at this time. Paddy -- Pádraic Brady http://blog.astrumfutura.com http://phpsecurity.readthedocs.org Zend Framework Community Review Team Zend Framework PHP-FIG Representative