Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

I am getting an message about 'obsolete cryptography' from Chrome.

Your connection to (site) is encrypted with obsolete cryptography.

The connection is encrypted using AES_256_CBC...

Per this answer, I am trying to disable CBC in favour of GCM ciphers.

However, whether I remove the non-GCM ciphers via '!' blacklists or simply do not include them in the first place, Chrome always negotiates a CBC cipher.

Following the OpenSSL docs, I have pared down my cipher list to the following:

'ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256'

or, more readably:

"ECDHE-RSA-AES256-GCM-SHA384",
"ECDHE-ECDSA-AES256-GCM-SHA384",
"ECDHE-RSA-AES128-GCM-SHA256",
"ECDHE-ECDSA-AES128-GCM-SHA256",
"DHE-DSS-AES256-GCM-SHA384",
"DHE-RSA-AES256-GCM-SHA384",
"DHE-RSA-AES128-GCM-SHA256",
"DHE-DSS-AES128-GCM-SHA256"

(then joining the array to make the string)

Which openssl seems to like:

openssl ciphers -V 'ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256'
          0xC0,0x30 - ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AESGCM(256) Mac=AEAD
          0xC0,0x2C - ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESGCM(256) Mac=AEAD
          0xC0,0x2F - ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH     Au=RSA  Enc=AESGCM(128) Mac=AEAD
          0xC0,0x2B - ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESGCM(128) Mac=AEAD
          0x00,0xA3 - DHE-DSS-AES256-GCM-SHA384 TLSv1.2 Kx=DH       Au=DSS  Enc=AESGCM(256) Mac=AEAD
          0x00,0x9F - DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH       Au=RSA  Enc=AESGCM(256) Mac=AEAD
          0x00,0x9E - DHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=DH       Au=RSA  Enc=AESGCM(128) Mac=AEAD
          0x00,0xA2 - DHE-DSS-AES128-GCM-SHA256 TLSv1.2 Kx=DH       Au=DSS  Enc=AESGCM(128) Mac=AEAD

However, after restarting the server with these ciphers, Chrome still says:

The connection is encrypted using AES_256_CBC

How can I properly exclude CBC ciphers from openssl?

Edit: Chrome 44 negotiates correctly. Chrome 42 (the current stable) does not:

enter image description here

Edit 2: Yes, honorCipherOrder is enabled.

share|improve this question

migrated from crypto.stackexchange.com May 6 at 19:38

This question came from our site for software developers, mathematicians and others interested in cryptography.

2 Answers 2

It's not up to the client no negotiate that. The server has the last word in this. Chrome can not pick anything the server is not offering.

Check your server with SSL Labs (be sure to check the "Do not show the results on the boards" checkbox)
https://www.ssllabs.com/ssltest/

share|improve this answer
    
I'm aware that Chrome can not pick anything the server is not offering - that's why I'm puzzled - see the cipher list in the question, which does not include CBC. I already have checked with SSL labs: they use the same ciphers as Chrome 44. –  mikemaccana May 6 at 18:48
    
Okay. Sniff with WireShark then. The client hello and server hello are plain text. What do they say? I suspect the server is offering some suites that it shouldn't. If that doesn't help, then decrypt the stream and look at what cipher suite was actually picked. (See: jimshaver.net/2015/02/11/…) –  StackzOfZtuff May 6 at 19:35
    
An excellent suggestion, and already done: pcap of Server Hello shows Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f) ie a GCM cipher. –  mikemaccana May 6 at 19:40
    
A colleague I showed the pcap to noted that there's server hello's for other sites, some of which use CBC. It's possible Chrome 42 shows the warning for embedded resources, but Chrome 44 does not. Going to try disabling some of those embedded resources now. –  mikemaccana May 6 at 19:45

Our own servers cipher suites were correct, but Embedded resources also trigger the warnings - in our case, Mixpanel (an analytics company) uses CBC on their servers:

enter image description here

Anything other than AES-GCM or CHACHA20_POLY1305 - ie, CBC is marked as obsolete by Chrome:

In order for the message to indicate “modern cryptography”, the connection should use forward secrecy and either AES-GCM or CHACHA20_POLY1305. Other cipher suites are known to have weaknesses.

Disabling Mixpanel removes the warning in Chrome 42. I've raised the issue to Mixpanel support so they can fix.

share|improve this answer
    
Your Chrome link does not mention CBC. –  StackzOfZtuff May 6 at 22:19
    
@StackzOfZtuff that's correct. The relevant part of that link is: "In order for the message to indicate “modern cryptography”, the connection should use forward secrecy and either AES-GCM or CHACHA20_POLY1305. Other cipher suites are known to have weaknesses." I've edited my answer to make this more apparent. –  mikemaccana May 6 at 22:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.