helpGnuTLS - Support: sr #108577, disabling insecure cipher suite...


sr #108577: disabling insecure cipher suite TLS_DHE_DSS_WITH_RC4_128_SHA

Submitted by:  Seth <sysfu>
Submitted on:  Wed 21 May 2014 08:53:39 AM UTC  
Category:  Core library Priority:  5 - Normal
Severity:  3 - Normal Status:  Invalid
Privacy:  Public Assigned to:  None
Open/Closed:  Closed Operating System:  None

Add a New Comment (Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


Thu 22 May 2014 06:55:49 PM UTC, comment #5: 

Thanks for looking into this.  I filed

Michael Catanzaro <mcatanzaro>
Thu 22 May 2014 05:55:29 PM UTC, comment #4: 

It is a bug of howmyssl then. TLS_DHE_DSS_WITH_RC4_128_SHA was added in a document from microsoft that mainly added 56-bit ciphersuites, and the makers of howmyssl probably thought it was a 56-bit one. It is not and it is marked as such in the document below.

Nikos Mavrogiannopoulos <nmav>
Project Administrator
Thu 22 May 2014 03:57:01 PM UTC, comment #3: 

That can't be right, since howsmyssl is fine with both TLS_RSA_WITH_RC4_128_SHA and TLS_RSA_WITH_RC4_128_MD5.  It's failing us specifically for TLS_DHE_DSS_WITH_RC4_128_SHA.

Firefox does not support TLS_DHE_DSS_WITH_RC4_128_SHA and does pass the howsmyssl test.

Michael Catanzaro <mcatanzaro>
Wed 21 May 2014 02:51:22 PM UTC, comment #2: 

Regarding the complete removal of RC4 support and the idea that even a vulnerable RC4 HTTPS connection is better that a clear-text HTTP connection, I'm struggling with that.

It seems to me that providing a false sense of security for the end user with RC4 HTTPS is actually worse than HTTP. At least with fall-back to clear-text HTTP I would hope that the user would understand (if they're going to understand at all) that their traffic is unencrypted, thus they should behave accordingly.

If the user cannot connect at all due to RC4 support being yanked, this is a powerful incentive to go looking for browser software that will actually work and also do an acceptable job of keeping their web traffic secure because I works.


Seth <sysfu>
Wed 21 May 2014 09:26:05 AM UTC, comment #1: 

This particular one you can easily disable by adding -DHE-DSS to the priority string. But I guess the insecure part is the RC4-128, so other "insecure" ciphersuites will pop-up. As the situation is now removing RC4 completely will prevent HTTPS access to a number of web sites. That is worse than RC4 as the alternative to no HTTPS access is HTTP.

You can see the stats of a recent server survey at:

Nikos Mavrogiannopoulos <nmav>
Project Administrator
Wed 21 May 2014 08:53:39 AM UTC, original submission:  

There are several web browsers which utilize libsoup and GnuTLS which are currently earning a "Bad" rating from due to the presence of the insecure cipher suite TLS_DHE_DSS_WITH_RC4_128_SHA.

Am curious to know if this nasty little cipher suite could be safely be disabled by default in GnuTLS without wreaking too much compatibility havoc.

Reference lipsoup bug here:

Seth <sysfu>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by mcatanzaro (Posted a comment)
  • -email is unavailable- added by nmav (Posted a comment)
  • -email is unavailable- added by sysfu (Submitted the item)

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.




    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-05-26 nmav StatusNone => Invalid
        Open/ClosedOpen => Closed

    Back to the top

    Powered by Savane 3.5