In WinCairo port some deprecated cipher suites are enabled. We remove those cipher suites and enable stronger algorithms, for reducing handshake time.
Created attachment 405537 [details] Patch
Looks good to me. If possible, can you point the default set of ciphers libcurl uses? It is not clear which cipher suites are removed.
(In reply to Basuke Suzuki from comment #2) > Looks good to me. > > If possible, can you point the default set of ciphers libcurl uses? It is > not clear which cipher suites are removed. In WinCairo port cipher suites below are enabled. AES_128_GCM_SHA256 CHACHA20_POLY1305_SHA256 AES_256_GCM_SHA384 ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 ECDHE_RSA_WITH_AES_128_GCM_SHA256 ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 ECDHE_RSA_WITH_AES_256_GCM_SHA384 ECDHE_ECDSA_WITH_AES_256_CBC_SHA ECDHE_ECDSA_WITH_AES_128_CBC_SHA ECDHE_RSA_WITH_AES_128_CBC_SHA ECDHE_RSA_WITH_AES_256_CBC_SHA DHE_RSA_WITH_AES_128_CBC_SHA DHE_RSA_WITH_AES_256_CBC_SHA RSA_WITH_AES_128_CBC_SHA RSA_WITH_AES_256_CBC_SHA RSA_WITH_3DES_EDE_CBC_SHA
Cipher suites below are disabled. RSA_WITH_RC4_128_MD5 RSA_WITH_RC4_128_SHA DHE_RSA_WITH_3DES_EDE_CBC_SHA RSA_WITH_AES_128_CBC_SHA256 RSA_WITH_AES_256_CBC_SHA256 RSA_WITH_CAMELLIA_128_CBC_SHA DHE_RSA_WITH_CAMELLIA_128_CBC_SHA DHE_RSA_WITH_AES_128_CBC_SHA256 DHE_RSA_WITH_AES_256_CBC_SHA256 GOSTR341001_WITH_28147_CNT_IMIT RSA_WITH_CAMELLIA_256_CBC_SHA DHE_RSA_WITH_CAMELLIA_256_CBC_SHA DHE_RSA_WITH_AES_128_GCM_SHA256 RSA_WITH_AES_128_GCM_SHA256 RSA_WITH_AES_256_GCM_SHA384 DHE_RSA_WITH_AES_256_GCM_SHA384 RSA_WITH_CAMELLIA_128_CBC_SHA256 DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 RSA_WITH_CAMELLIA_256_CBC_SHA256 DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 ECDHE_ECDSA_WITH_RC4_128_SHA ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA ECDHE_RSA_WITH_RC4_128_SHA ECDHE_RSA_WITH_3DES_EDE_CBC_SHA ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 ECDHE_RSA_WITH_AES_128_CBC_SHA256 ECDHE_RSA_WITH_AES_256_CBC_SHA384 DHE_RAS_WITH_CHACHA20_POLY1305_SHA256
Default cipher suites for curl before applying the patch are suites summed up enabled and disabled.
Comment on attachment 405537 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=405537&action=review > Tools/ChangeLog:11 > + For testing enabled/diabled ciphers we added HTTPServer.cpp which uses TCPServer.cpp Bug 215379 is going to land HTTPServer as a separate patch. Let's redo this patch after Bug 215379.
Pull request: https://github.com/WebKit/WebKit/pull/6582
Committed 256775@main (597ffc8de927): <https://commits.webkit.org/256775@main> Reviewed commits have been landed. Closing PR #6582 and removing active labels.
<rdar://problem/102455626>