1

I need to know if Mozilla Firfox implements the SCSV which adds a specific ciphersuite in case if the client initial hello message is resent (either due to MITM or due to network erro).

I opened about:config and checked the supported ciphersuites. I can not find the SCSV cipher. Why Firefox does not implement this protection mechanism? Are you aware of any brosers that do so?

0

SCSV is not a real cipher but only a pseudo-cipher, i.e. a hack to notify that the client currently does a TLS fallback. And because it is not a real cipher there is no way to enable or disable it as cipher.

| improve this answer | |
  • Thanks. Then, how can I check whether Firefox implements it or not? – user6875880 Mar 7 '17 at 14:49
  • 2
    @user6875880: according to security.stackexchange.com/questions/94848/… Firefox should support it. But to try yourself you need to make TLS 1.2 to fail (maybe with a custom server) so that you can watch a downgrade to TLS 1.0 with tcpdump or wireshark. – Steffen Ullrich Mar 7 '17 at 16:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.