The question is which browsers are known not to support Forward Secrecy and the Diffie-Hellman (DHE) or Elliptic Curve cryptography (ECDHE) ciphers? We have clients who are demanding we support forward secrecy for them to continue to use our products. We need to determine if it may have an affect on other clients which may not be on latest browsers. Are there any lists of known, or unknown support browsers. Our F5 will be setup to use Elliptic Curve cryptography (ECDHE) ciphers.

  • 1
    This is really two questions in one. And the answer only relates to the first question. – mikemaccana Dec 18 '15 at 17:32

Most browsers (all the major ones) allow you to change the set of cipher suites in use. Some may require obscure ways to do this (I'm looking at you chrome) and others may depend upon the cryptography packages provided by the operating systems.

Chrome, Opera and Firefox support FS pretty well out of the box. IE and Safari will require some tweaking. Check out SSL Lab's list of user agent capabilities.

Forward secrecy involves the use of ephemeral keys which are not transmitted across the network. This assumes that neither side has been compromised. Qualys has a good overview of FS.

  • Do you mean tweaking for it to support it at all. As a user would need to change setting to connect to our site only using ECDHE ciphers? – Brettski Apr 13 '15 at 17:04
  • 1
    @Brettski, I think that most (modern) browsers would support DHE or ECDHE out of the box, but I'm not really sure. The issue I was really bringing up was that the browsers may not choose a cipher suite using DHE or ECDHE. If your site is only going to support cipher suites with DHE or ECDHE, then it won't be a problem. – COL Wotohice Apr 13 '15 at 17:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.