Skip to content
GitLab
Projects Groups Topics Snippets
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in
  • Tor Browser Tor Browser
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributor statistics
    • Graph
    • Compare revisions
  • Issues 856
    • Issues 856
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 6
    • Merge requests 6
  • Deployments
    • Deployments
    • Releases
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • Repository
  • Wiki
    • Wiki
  • Activity
  • Graph
  • Create a new issue
  • Commits
  • Issue Boards
Collapse sidebar
  • The Tor Project
  • Applications
  • Tor BrowserTor Browser
  • Issues
  • #18274
Closed
Open
Issue created Feb 07, 2016 by bugzilla@bugzilla

3DES_EDE_CBC cipher is weak in the current TBB configuration!

From The Design and Implementation of the Tor Browser [DRAFT]:

we also enable TLS False Start via the Firefox Pref security.ssl.enable_false_start. From TLS False Start https://tools.ietf.org/html/draft-bmoeller-tls-falsestart-00 generally symmetric ciphers with an effective key length of 128 bits or more can be considered strong. In TLS 1.2 [RFC5246], this allows all cipher suites except those using the NULL or 3DES_EDE_CBC ciphers Detected by https://www.ssllabs.com/ssltest/viewMyClient.html TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) 112 In about:config: security.ssl3.rsa_des_ede3_sha;true Why is this security hole still present?

Assignee
Assign to
Time tracking