[BlueOnyx:16963] Re: ssl Forward Secrecy

[Michael Stauber]

Hi Steffan,

> The server does not support Forward Secrecy with the
> reference browsers. Grade reduced to A-.

The SSLlabs score of A- is as good as it gets and it took me a lot of
fiddling to get us there. You said it yourself: Google scores just a
meager "B".

As for "does not support Forward Secrecy with the reference browsers":

SSLlabs lists Internet Explorer on Windows XP and Java6u45 among their
reference browsers.

Both only support very weak cipher suites that we do not allow. XP is
also End of Live, so we don't worry about it.

That leaves some other Windows browsers which in theory allow Forward
Secrecy. It boils down to Android 4.4.2, Chrome 39 on OSX and IE11 on
Win 8.1 and Win 10. These also have in common that they don't support
the really strong SSL ciphers and they only offer Forward Secrecy with
weaker ciphers. What you have there are typical US companies, which
under pressure from the elected crooks caved in and crippled their
software so that the NSA has an easier job spying on everyone.

So I settled for the compromise suggested by the cryptology experts from
cryptome.io: I configured BlueOnyx to use a mixture of ciphers that's
among the best that's out there and supported by the underlying OS. This
supports Forward Secrecy for most browsers. On those where Forward
Secrecy is not an option with that, it falls back to the best cipher
without FS, which is still a hell of a lot better than what these
browsers would (by their own defaults) use if we let them pick cipher
and protocol themselves.

Especially Windows browsers have a tendency to insist on using the RC4
ciphers, which are a horrible idea, as RC4 is known to be broken.

> I tested it aganst google. They have it enabled but also they have
> enabled ssl3 and using sha1 so they score a B

Yeah, SSLv3 is no longer a viable option and should be disabled.
Likewise: Our SSL certificates are (by default) hashed with SHA256 these
days, as SHA1 is broken.

TL;DR: It's all good. Don't worry.

-- 
With best regards

Michael Stauber