6

This websites gives you information on the SSL cipher suites your browser supports for securing HTTPS connections.

If you browse it with Google Chrome, you'll probably see some weird Cipher Suites in your browser supported Cipher Suites list. (You'll see them in the first suggested Cipher Suite location and also in the extensions section):

look at baba in the image below (and also the 3a3a in the extensions): enter image description here

It seems that this number is random. I mean if you refresh the page, those number will change:

look at dada in the image below (and also the 1a1a in the extensions): enter image description here

What are these random weird numbers? If those are chrome's proprietary cipher suites (those are not common cipher suites), why should chrome change them randomly?

9

This is a feature to prevent servers to get buggy. From GREASE for TLS:

TLS clients offer lists of 16-bit code points (e.g. cipher suites) that servers select from. To remain extensible, servers must ignore unknown values. However, servers may have bugs and reject unknown values. These servers will interoperate with existing clients, so the mistake may spread unnoticed, breaking extensibility for the whole ecosystem. We will reserve some values to advertise at random, to prevent such mistakes before broken servers are widespread.

And once you know how it is called you can also find the feature in the source code of BoringSSL (the OpenSSL fork used by Chrome).

  // Add a fake cipher suite. See draft-davidben-tls-grease-01.
  if (ssl->ctx->grease_enabled &&
      !CBB_add_u16(&child, ssl_get_grease_value(ssl, ssl_grease_cipher))) {
    return 0;
  }

And the values it will announce can be found in the internet draft:

  |       Value       | Description | DTLS-OK |    Reference    |
  +-------------------+-------------+---------+-----------------+
  | {TBD} {0x0A,0x0A} |   Reserved  |    Y    | (this document) |
  | {TBD} {0x1A,0x1A} |   Reserved  |    Y    | (this document) |
  | {TBD} {0x2A,0x2A} |   Reserved  |    Y    | (this document) |
  | {TBD} {0x3A,0x3A} |   Reserved  |    Y    | (this document) |
  ...
  | {TBD} {0xEA,0xEA} |   Reserved  |    Y    | (this document) |   
  | {TBD} {0xFA,0xFA} |   Reserved  |    Y    | (this document) |   

Note that this answer here is based on my answer to a similar question in stackoverflow.com.

  • Are you sure that there is no relation between these random numbers and Decoy Routing anti-censorship technique? – Abraham Jan 7 '18 at 9:49
  • @Abraham: yes, I'm pretty sure. It is a documented behavior. And see edit with a reference to the source code. – Steffen Ullrich Jan 7 '18 at 9:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.