[tor-bugs] #4744 [Tor Bridge]: GFW probes based on Tor's SSL cipher list (?)

[Tor Bug Tracker & Wiki]

#4744: GFW probes based on Tor's SSL cipher list (?)
------------------------+---------------------------------------------------
 Reporter:  asn         |          Owner:  nickm             
     Type:  defect      |         Status:  accepted          
 Priority:  major       |      Milestone:  Tor: 0.2.3.x-final
Component:  Tor Bridge  |        Version:                    
 Keywords:              |         Parent:  #4185             
   Points:              |   Actualpoints:                    
------------------------+---------------------------------------------------

Comment(by asn):

 Replying to [comment:3 nickm]:
 > I think that editing ciphers.inc to match this might be sensible.
 >
 > Some questions:
 >
 >   - How did you you make this list?

 I connected to a Tor relay's ORPort using Firefox 8.0 and HTTPS. I had
 'Use SSL 3.0' and 'Use TLS 1.0' ticked, in my Preferences -> Advanced ->
 Encryption tab.
 Then I checked the ClientHello packet in Wireshark.

 Afterwards, I double-checked my findings with the security-prefs.js file I
 mentioned in comment:2, and they seemed to match.

 You should try it too to make sure I got it right.

 >   - What exactly is your environment here? Does the same thing happen
 with the latest mainstream firefox?  How about Chrome?

 A Debian testing machine, using
 http://packages.debian.org/wheezy/iceweasel .
 I haven't tried with the 9.0 branch of Firefox. I should do this.
 I haven't tried with Chrome. I should do this.

 >   - Does openssl send the TLS_EMPTY_RENEGOTIATION_INFO_SCSV value? I
 worry adding it on our own could lead to trouble and incompatibility.

 I think modern OpenSSL automatically adds the
 TLS_EMPTY_RENEGOTIATION_INFO_SCSV in the first ClientHello of an SSL
 session. Take a look at `ssl_lib.c:ssl_cipher_list_to_bytes()`.

 I'm not sure what libnss does. I noticed that it '''sends''' the SCSV when
 both 'Use SSL 3.0' ''and'' 'Use TLS 1.0' are ticked, but it '''doesn't'''
 send the SCSV when ''only'' 'Use TLS 1.0' is ticked.

 I think that explicitly adding the SCSV ourselves is a bad idea
 (especially, since I suspect that OpenSSL will happily add a second SCSV
 on its own), but we should look into it.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/4744#comment:6>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online