envoyproxy/envoy

Remove SHA-1 cipher suites from the defaults on the server-side

Open

#5,400 opened on Dec 22, 2018

View on GitHub
 (0 comments) (0 reactions) (0 assignees)C++ (5,373 forks)batch import
area/tlshelp wanted

Repository metrics

Stars
 (27,997 stars)
PR merge metrics
 (Avg merge 8d) (378 merged PRs in 30d)

Description

This is the intent to remove remaining SHA-1 cipher suites (i.e. ECDHE-ECDSA-AES128-SHA, ECDHE-RSA-AES128-SHA, ECDHE-ECDSA-AES256-SHA and ECDHE-RSA-AES256-SHA) from the default cipher suites on the server-side.

This change will affect your deployment if it's using default cipher suites (i.e. not configuring cipher_suites) and it's accepting incoming connections using those cipher suites:

$ curl -s localhost:9901/stats | grep -E "^listener.*.ssl.ciphers..*SHA:"
listener.<address>.ssl.ciphers.ECDHE-ECDSA-AES128-SHA: 1
listener.<address>.ssl.ciphers.ECDHE-ECDSA-AES256-SHA: 1
listener.<address>.ssl.ciphers.ECDHE-RSA-AES128-SHA: 1
listener.<address>.ssl.ciphers.ECDHE-RSA-AES256-SHA: 1

(This works only with Envoy v1.9.0 and newer)

ETA: 1.15 (i.e. ~late 2020)

Contributor guide

Research direction
Locate the default cipher suites definition in the Envoy source code (likely in a configuration file or source file). Remove the four SHA 1 cipher suites from the list. Ensure that the change updates any test expectations that list the default ciphers. Verify with the provided curl command to confirm no SHA 1 ciphers appear.
Tech stack
None
Domain
security
Issue type
Security
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Mostly clear
Prerequisites
C++SSL/TLS basics
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
55