1

I need to know if Mozilla Firfox implements the SCSV which adds a specific ciphersuite in case if the client initial hello message is resent (either due to MITM or due to network erro).

I opened about:config and checked the supported ciphersuites. I can not find the SCSV cipher. Why Firefox does not implement this protection mechanism? Are you aware of any brosers that do so?

1 Answer 1

0

SCSV is not a real cipher but only a pseudo-cipher, i.e. a hack to notify that the client currently does a TLS fallback. And because it is not a real cipher there is no way to enable or disable it as cipher.

2
  • Thanks. Then, how can I check whether Firefox implements it or not? Commented Mar 7, 2017 at 14:49
  • 2
    @user6875880: according to security.stackexchange.com/questions/94848/… Firefox should support it. But to try yourself you need to make TLS 1.2 to fail (maybe with a custom server) so that you can watch a downgrade to TLS 1.0 with tcpdump or wireshark. Commented Mar 7, 2017 at 16:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .