1107787 - Disable TLS_DHE_DSS_WITH_AES_128_CBC_SHA support

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[Masatoshi Kimura [:emk]]

According to bug 970254 comment #11, Chrome will also drop the support soon.

Comment 1

[Masatoshi Kimura [:emk]]

The removal commit of BoringSSL:
https://boringssl.googlesource.com/boringssl/+/ef2116d33c3c1b38005eb59caa2aaa6300a9b450

Comment 2

[Masatoshi Kimura [:emk]]

Chromium already switched to BoringSSL on OS X:
https://code.google.com/p/chromium/issues/detail?id=338885

Comment 3

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Attachment: remove-last-dss-cipher-suites.patch

This patch disables the cipher suite by switching the default value of the pref. If/when this lands, I'll file a follow-up bug for removing the pref, just like we've done for other disabled/removed cipher suites.

Comment 4

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

The compatibility impact information is in bug 1073867 comment 2. Should be minimal, especially considering Chrome's changes.

Comment 5

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

This needs to be applied on top of the patch for bug 1037098 to avoid merge conflicts.

Comment 6

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

https://treeherder.mozilla.org/ui/#/jobs?repo=try&revision=0300c3cdb668

Comment 7

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/526bb391ba63

Comment 8

[Ryan VanderMeulen [:RyanVM][PTO Jan 25 - Feb 2]]

https://hg.mozilla.org/mozilla-central/rev/526bb391ba63