6

HSTS allows me to force clients to connect to my website using HTTPS, but it doesn't specify the version of SSL, TLS, or what ciphers I'm prohibiting.

Is there any HSTS alternative or extension that allows me to specify

  • TLS minimum version (1.2)
  • TLS Ciphers (those listed in TLS 1.3)
  • 4
    User agent will negotiate with the server, for version and ciphers. If you only offer the version and ciphers you want on your server, then that's all the client can use... – Neil McGuigan Sep 12 '15 at 2:02
7

In TLS, the client proposes and the server chooses.

What you want it as simple as configuring your servers to only allow TLS 1.2 and the particular server suites you want to use. There isn't a need for anything special.

  • This won't stop a client connecting to a rogue server on the undesired protocol version – paj28 Sep 12 '15 at 11:59
  • 2
    @paj28 the rogue server shouldn't be able to get a certificate for your domain name, and if it can your security is already toast: it can trivially implement whatever protocols and ciphers the real server does. – dave_thompson_085 Sep 12 '15 at 13:28
  • @dave_thompson_085 - This question was specifically about HSTS-like protection for TLS version. You're probably aware that HSTS stops clients talking to rogue plain-HTTP servers; it does more than simply disabling plain-HTTP on your server. If you don't trust an old version of TLS, maybe you don't trust it to properly verify the server's identity. – paj28 Sep 13 '15 at 15:05
  • @paj28 A HSTS-like thing for TLS versions and/or ciphersuites is completely irrelevant. The main point of HSTS is to stop MITM attacks that downgrade HTTPS connections to HTTP by decreeing to the client that all connections shall be HTTPS or fail (instead of silently falling back on HTTP). When it comes to TLS versions and cipher suites, the client does not have a say in the final choice at all. – Ayrx Sep 13 '15 at 15:17
  • @TerryChia - Clearly I'm not getting my point across in these comments, so I have provided an alternative answer. – paj28 Sep 13 '15 at 15:35
1

No - there is no such mechanism, and it is unlikely that one will be developed.

First a recap: HSTS allows a server to force clients to use HTTPS for a particular domain. Without HSTS, I can enable SSL on mydomain.com, but there is a risk that a attacker site could hijack a client (e.g. by DNS poisoning), and serve unauthorised plain-HTTP content for mydomain.com. Good user awareness has always been able prevent this (check the padlock), but the point of HSTS is that it gives protection even for novice users.

When it comes to TLS versions, as Terry Chia says, you can decide what versions you want your server to support. It's possible that a rogue server would try to impersonate your server, and use TLS versions that you have not enabled. But they would have to have a certificate for your domain - or some kind of vulnerability in an old version of TLS that they are exploiting. Considering that the published TLS protocol vulnerabilities are subtle issues that would not allow impersonation without a certificate, no-one is interested in developing such a system.

  • For what it's worth, I'd be interested in seeing such a system. It's always easy to see the necessary protections in retrospect, but potential future problems aren't addressed proactively as often as I'd like. Also, it makes me quite sad to see somebody with @Terry Chia's reputation talking about "the main point" of a security measure as though anything else it does is irrelevant. – CBHacking Sep 14 '15 at 3:01
  • For example, HSTS also can be used to protect against some MitM attacks that are possible against a site that already uses HTTPS. Trivial example that I've seen in the wild: attacker injects malicious reference to target site (like <img src="http://targetsite.com/" />) into an unrelated HTTP response, then intercepts this request to targetsite and sets a cookie that will be reflected into the page body. Next time the victim loads the site (over HTTPS), attacker has XSS. HSTS can prevent that, even though it's not the "main point" of it. – CBHacking Sep 14 '15 at 3:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.