If a client presents a higher cipher suite during
ClientHello yet eventually negotiates a lower strength cipher suite within the same protocol version, though a higher cipher suite is available on both client and server, who is responsible?
According to How does SSL/TLS work? it is
ServerHello which ultimately decides the cipher suite.
From that post:
To remember: the client suggests but the server chooses. The cipher suite is in the hands of the server. Courteous servers are supposed to follow the preferences of the client (if possible), but they can do otherwise and some actually do (e.g. as part of protection against BEAST).
To understand this question better, an example is provided below.
Example With Firefox:
There is a Client (A) and a Server (B).
Client (A) is a Firefox version 65 browser.
Server (B) is a web server serving a site over https.
Connections to Server (B) @ site.server.com are being negotiated from a stronger TLS 1.2 cipher suite to a less strong TLS 1.2 cipher suite, even when a stronger cipher suite is available on both the client and the server. This behavior is confirmed on Firefox 65.
Steps to Reproduce:
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256and all other weaker cipher suites in Firefox then reload site.server.com The site will load with
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384enabled as well then reload site.server.com.
The weaker cipher suite will be chosen.
In this scenario, who was responsible?