You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
53 lines
2.3 KiB
53 lines
2.3 KiB
diff --git a/Lib/ssl.py b/Lib/ssl.py |
|
index 038daa4..5311321 100644 |
|
--- a/Lib/ssl.py |
|
+++ b/Lib/ssl.py |
|
@@ -143,38 +143,36 @@ if _ssl.HAS_TLS_UNIQUE: |
|
else: |
|
CHANNEL_BINDING_TYPES = [] |
|
|
|
+ |
|
# Disable weak or insecure ciphers by default |
|
# (OpenSSL's default setting is 'DEFAULT:!aNULL:!eNULL') |
|
# Enable a better set of ciphers by default |
|
# This list has been explicitly chosen to: |
|
# * Prefer cipher suites that offer perfect forward secrecy (DHE/ECDHE) |
|
# * Prefer ECDHE over DHE for better performance |
|
-# * Prefer any AES-GCM over any AES-CBC for better performance and security |
|
+# * Prefer AEAD over CBC for better performance and security |
|
# * Then Use HIGH cipher suites as a fallback |
|
-# * Then Use 3DES as fallback which is secure but slow |
|
# * Finally use RC4 as a fallback which is problematic but needed for |
|
# compatibility some times. |
|
-# * Disable NULL authentication, NULL encryption, and MD5 MACs for security |
|
-# reasons |
|
+# * Disable NULL authentication, NULL encryption, 3DES and MD5 MACs |
|
+# for security reasons |
|
_DEFAULT_CIPHERS = ( |
|
'ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+HIGH:' |
|
- 'DH+HIGH:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+HIGH:RSA+3DES:ECDH+RC4:' |
|
- 'DH+RC4:RSA+RC4:!aNULL:!eNULL:!MD5' |
|
+ 'DH+HIGH:RSA+AESGCM:RSA+AES:RSA+HIGH:ECDH+RC4:DH+RC4:RSA+RC4:!aNULL:!eNULL:' |
|
+ '!MD5:!3DES' |
|
) |
|
|
|
# Restricted and more secure ciphers for the server side |
|
# This list has been explicitly chosen to: |
|
# * Prefer cipher suites that offer perfect forward secrecy (DHE/ECDHE) |
|
# * Prefer ECDHE over DHE for better performance |
|
-# * Prefer any AES-GCM over any AES-CBC for better performance and security |
|
+# * Prefer AEAD over CBC for better performance and security |
|
# * Then Use HIGH cipher suites as a fallback |
|
-# * Then Use 3DES as fallback which is secure but slow |
|
-# * Disable NULL authentication, NULL encryption, MD5 MACs, DSS, and RC4 for |
|
-# security reasons |
|
+# * Disable NULL authentication, NULL encryption, MD5 MACs, DSS, RC4, and |
|
+# 3DES for security reasons |
|
_RESTRICTED_SERVER_CIPHERS = ( |
|
'ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+HIGH:' |
|
- 'DH+HIGH:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+HIGH:RSA+3DES:!aNULL:' |
|
- '!eNULL:!MD5:!DSS:!RC4' |
|
+ 'DH+HIGH:RSA+AESGCM:RSA+AES:RSA+HIGH:!aNULL:!eNULL:!MD5:!DSS:!RC4:!3DES' |
|
) |
|
|
|
|
|
|