Subject: [saag] ffox and chrome offer sha1 and then puke

From: Randy Bush <[email-masked]>
Date: Sun, 18 Mar 2018 09:36:23 +0000

i am using both ffox 59.01 and chrome 65.0.3325.162 on latest macos high
sierra.

i am trying to connect to mycheckfree.com

ffox and chrome are offering sha1 and then puking when the site selects
it.

what the heck?

randy

---

From: Viktor Dukhovni <[email-masked]>
Date: Sun, 18 Mar 2018 11:16:14 -0400

> On Mar 18, 2018, at 5:36 AM, Randy Bush <[email-masked]> wrote:
> 
> I am using both ffox 59.01 and chrome 65.0.3325.162 on latest macos high sierra.

Ditto.

> I am trying to connect to mycheckfree.com
> 
> ffox and chrome are offering sha1 and then puking when the site selects it.

I observe no involuntary discharge from either Chrome:

   Connection - obsolete connection settings
   The connection to this site uses TLS 1.2 (a strong protocol),
   RSA (an obsolete key exchange), and AES_256_CBC
   with HMAC-SHA1 (an obsolete cipher).

or firefox:

Perhaps some middle-box or other obstacle on your end?
You'll want a PCAP file and tshark to shed more light on this:

  # tcpdump -s0 -w /tmp/pkts.pcap tcp port 443 and host mycheckfree.com
  ... <CTRL-C> after browser connection to the site ...

  $ tshark -r /tmp/pkts.pcap -d tcp.port==443,ssl -V |
      sed -ne '/^Secure Sockets Layer/,/^$/p'

-- 
	Viktor.

---

From: Randy Bush <[email-masked]>
Date: Sun, 18 Mar 2018 20:05:35 +0000

[ off list ]

>       sed -ne '/^Secure Sockets Layer/,/^$/p'

the mac is on the naked global internet, the ietf network.  safari
worked.  can try to debug more in next day or so.

randy