2052296 - Add a pref and enterprise policy to enable CNSA2.0 key agreement

Status: RESOLVED FIXED

(Core :: Security: PSM, enhancement, P2)

Comment 1

[John Schanck [:jschanck]]

Attachment: Bug 2052296 - add a pref and enterprise policy for CNSA2.0 key agreement. r=keeler

Comment 2

[Mike Kaply [:mkaply]]

Chrome appears to have implemented this as two policies:

PreferSlowKexAlgorithms
https://chromeenterprise.google/policies/prefer-slow-kex-algorithms/

PreferSlowCiphers
https://chromeenterprise.google/policies/prefer-slow-kex-algorithms/#PreferSlowCiphers

I'm wondering if we should copy...

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/36f823124294
https://hg.mozilla.org/integration/autoland/rev/a619462e1d21
add a pref and enterprise policy for CNSA2.0 key agreement. r=keeler,fluent-reviewers,mkaply,flod

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/054675d1c263
https://hg.mozilla.org/integration/autoland/rev/e0dce5d24a1a
Revert "Bug 2052296 - add a pref and enterprise policy for CNSA2.0 key agreement. r=keeler,fluent-reviewers,mkaply,flod" for causing failures at test_sorted_alphabetically.js.

Comment 5

[Atila Butkovits]

Backed out for causing failures at test_sorted_alphabetically.js.

Backout link: https://hg.mozilla.org/integration/autoland/rev/e0dce5d24a1a

Push with failures: https://treeherder.mozilla.org/jobs?repo=autoland&resultStatus=testfailed%2Cbusted%2Cexception%2Cretry%2Cusercancel&revision=a619462e1d214536f43a620253b458649b2da4be&selectedTaskRun=Ns0gQeolSkW5tFJo77rB7A.0

Failure log: https://treeherder.mozilla.org/logviewer?job_id=579215101&repo=autoland&task=Ns0gQeolSkW5tFJo77rB7A.0&lineNumber=9810

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/46272f7868ed
https://hg.mozilla.org/integration/autoland/rev/c475e8046ca0
add a pref and enterprise policy for CNSA2.0 key agreement. r=keeler,fluent-reviewers,mkaply,flod

Comment 7

[amarc]

https://hg.mozilla.org/mozilla-central/rev/c475e8046ca0

Comment 8

[Mike Kaply [:mkaply]]

Does this need to go in the 153 ESR?

Comment 9

[John Schanck [:jschanck]]

The underlying key agreement algorithm is only available in NSS 3.126 / Firefox 154. We would only consider backporting the feature if there was a very strong reason to do so, and I'm not aware of one.