[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #4744 [Tor Bridge]: GFW probes based on Tor's SSL cipher list (?)
#4744: GFW probes based on Tor's SSL cipher list (?)
------------------------+---------------------------------------------------
Reporter: asn | Owner: nickm
Type: defect | Status: accepted
Priority: major | Milestone: Tor: 0.2.3.x-final
Component: Tor Bridge | Version:
Keywords: | Parent: #4185
Points: | Actualpoints:
------------------------+---------------------------------------------------
Comment(by asn):
Replying to [comment:3 nickm]:
> I think that editing ciphers.inc to match this might be sensible.
>
> Some questions:
>
> - How did you you make this list?
I connected to a Tor relay's ORPort using Firefox 8.0 and HTTPS. I had
'Use SSL 3.0' and 'Use TLS 1.0' ticked, in my Preferences -> Advanced ->
Encryption tab.
Then I checked the ClientHello packet in Wireshark.
Afterwards, I double-checked my findings with the security-prefs.js file I
mentioned in comment:2, and they seemed to match.
You should try it too to make sure I got it right.
> - What exactly is your environment here? Does the same thing happen
with the latest mainstream firefox? How about Chrome?
A Debian testing machine, using
http://packages.debian.org/wheezy/iceweasel .
I haven't tried with the 9.0 branch of Firefox. I should do this.
I haven't tried with Chrome. I should do this.
> - Does openssl send the TLS_EMPTY_RENEGOTIATION_INFO_SCSV value? I
worry adding it on our own could lead to trouble and incompatibility.
I think modern OpenSSL automatically adds the
TLS_EMPTY_RENEGOTIATION_INFO_SCSV in the first ClientHello of an SSL
session. Take a look at `ssl_lib.c:ssl_cipher_list_to_bytes()`.
I'm not sure what libnss does. I noticed that it '''sends''' the SCSV when
both 'Use SSL 3.0' ''and'' 'Use TLS 1.0' are ticked, but it '''doesn't'''
send the SCSV when ''only'' 'Use TLS 1.0' is ticked.
I think that explicitly adding the SCSV ourselves is a bad idea
(especially, since I suspect that OpenSSL will happily add a second SCSV
on its own), but we should look into it.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/4744#comment:6>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs