From 4ab75bd138b5792b175a5b23bb7acd4e8505612f Mon Sep 17 00:00:00 2001 From: Michiel Visser Date: Sat, 25 Nov 2023 21:12:05 +0100 Subject: [PATCH] LibTLS: Add comment to cipher suite list about Mozilla recommended order --- Userland/Libraries/LibTLS/TLSv12.h | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/Userland/Libraries/LibTLS/TLSv12.h b/Userland/Libraries/LibTLS/TLSv12.h index 86e5f510e3..06d404e2da 100644 --- a/Userland/Libraries/LibTLS/TLSv12.h +++ b/Userland/Libraries/LibTLS/TLSv12.h @@ -88,6 +88,12 @@ enum ClientVerificationStaus { // 4 bytes of fixed IV, 8 random (nonce) bytes, 4 bytes for counter // GCM specifically asks us to transmit only the nonce, the counter is zero // and the fixed IV is derived from the premaster key. +// +// The cipher suite list below is ordered based on the recommendations from Mozilla. +// When changing the supported cipher suites, please consult the webpage below for +// the preferred order. +// +// https://wiki.mozilla.org/Security/Server_Side_TLS #define ENUMERATE_CIPHERS(C) \ C(true, CipherSuite::TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, KeyExchangeAlgorithm::ECDHE_ECDSA, CipherAlgorithm::AES_128_GCM, Crypto::Hash::SHA256, 8, true) \ C(true, CipherSuite::TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, KeyExchangeAlgorithm::ECDHE_RSA, CipherAlgorithm::AES_128_GCM, Crypto::Hash::SHA256, 8, true) \