3 ms·

Dude your config is FUBAR. Why enforce TLS1.3 when you don’t understand that the way cipher suites are negotiated changed in TLS 1.3? > Also, my server decides

by NavinF 5y ago

Dude your config is FUBAR. Why enforce TLS1.3 when you don’t understand that the way cipher suites are negotiated changed in TLS 1.3? > Also, my server decides the selection of algorithms in TLSv1.3, not the web browsers SMH. Either use Caddy with an empty config file or follow Mozilla’s recommendation: https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=modern&openssl=1.1.1k&guideline=5.6 https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&... # modern configuration ssl_protocols TLSv1.3; ssl_prefer_server_ciphers off; Also lol are you trying to host your site via HE’s free tunnel?

deburo 5y ago
Would the cypher negotiation be the problem? I checked that Chrome supports Chacha/Poly, and it seems it does. - https://chromestatus.com/feature/5355238106071040 https://chromestatus.com/feature/5355238106071040 Chrome seems to support TLS 1.3 since v70, and I'm on 99. There's only the 0-RTT/EarlyData as far as I can tell that may be messing things up, is it required for TLS 1.3? It's not enabled by default yet (still in dev?). - https://chromestatus.com/feature/5447945241493504 https://chromestatus.com/feature/5447945241493504 - https://developers.cloudflare.com/ssl/edge-certificates/additional-options/tls-13/ https://developers.cloudflare.com/ssl/edge-certificates/addi...
- NavinF 5y ago
  Yes, you’re not supposed to specify the cipher suites with TLS1.3 This guy also forces secp521r1 (the NSA curve which is impossible to implement correctly, is unsupported by Chrome and eventually by Firefox, and is dog slow) instead of using DJB’s x25519. This is what roleplaying as an SRE looks like.
  - deburo 5y ago
    Thanks for the details!
  - egberts1 5y ago
    dog slow does not necessarily mean less secured. https://bugzilla.mozilla.org/show_bug.cgi?id=1128792 https://bugzilla.mozilla.org/show_bug.cgi?id=1128792 so far, absolutely no justification for Google to drop P-521: https://bugzilla.mozilla.org/show_bug.cgi?id=1129077 https://bugzilla.mozilla.org/show_bug.cgi?id=1129077 https://security.stackexchange.com/questions/100991/why-is-secp521r1-no-longer-supported-in-chrome-others https://security.stackexchange.com/questions/100991/why-is-s...
    - throwaway7033 5y ago
      The linked Mozilla bug report provides an excellent reason to drop P-521. If you look at the telemetry for last actual Firefox release, only 8 (yes, eight!) out of 1.67 BILLION handshakes used a P-521 curve. This is a good indication that P-521 isn't needed, at least for certificates verified by web browsers.
      - egberts1 5y ago
        Well, I need it. So, I get to have this. Isn’t the Internet awesome?
egberts1 5y ago
FUBAR, in terms of speed, but of course. because, TLSv1.3 negotiation capability is there. My server dictates the selection, lest the client gets the sideway algo slip. try it through your enterprise TLS transparent proxy. also, no HE IPv6 tunnel.

by NavinF 5y ago

deburo 5y ago

Would the cypher negotiation be the problem? I checked that Chrome supports Chacha/Poly, and it seems it does. - https://chromestatus.com/feature/5355238106071040 https://chromestatus.com/feature/5355238106071040 Chrome seems to support TLS 1.3 since v70, and I'm on 99. There's only the 0-RTT/EarlyData as far as I can tell that may be messing things up, is it required for TLS 1.3? It's not enabled by default yet (still in dev?). - https://chromestatus.com/feature/5447945241493504 https://chromestatus.com/feature/5447945241493504 - https://developers.cloudflare.com/ssl/edge-certificates/additional-options/tls-13/ https://developers.cloudflare.com/ssl/edge-certificates/addi...

NavinF 5y ago
Yes, you’re not supposed to specify the cipher suites with TLS1.3 This guy also forces secp521r1 (the NSA curve which is impossible to implement correctly, is unsupported by Chrome and eventually by Firefox, and is dog slow) instead of using DJB’s x25519. This is what roleplaying as an SRE looks like.
- deburo 5y ago
  Thanks for the details!
- egberts1 5y ago
  dog slow does not necessarily mean less secured. https://bugzilla.mozilla.org/show_bug.cgi?id=1128792 https://bugzilla.mozilla.org/show_bug.cgi?id=1128792 so far, absolutely no justification for Google to drop P-521: https://bugzilla.mozilla.org/show_bug.cgi?id=1129077 https://bugzilla.mozilla.org/show_bug.cgi?id=1129077 https://security.stackexchange.com/questions/100991/why-is-secp521r1-no-longer-supported-in-chrome-others https://security.stackexchange.com/questions/100991/why-is-s...
  - throwaway7033 5y ago
    The linked Mozilla bug report provides an excellent reason to drop P-521. If you look at the telemetry for last actual Firefox release, only 8 (yes, eight!) out of 1.67 BILLION handshakes used a P-521 curve. This is a good indication that P-521 isn't needed, at least for certificates verified by web browsers.
    - egberts1 5y ago
      Well, I need it. So, I get to have this. Isn’t the Internet awesome?

egberts1 5y ago

FUBAR, in terms of speed, but of course. because, TLSv1.3 negotiation capability is there. My server dictates the selection, lest the client gets the sideway algo slip. try it through your enterprise TLS transparent proxy. also, no HE IPv6 tunnel.