Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Cipher_Suites table to v5.x #296

Open
wants to merge 17 commits into
base: gh-pages
Choose a base branch
from

Conversation

janbrasna
Copy link

Fixes #247, #292, april/tls-table#4

Since the simplification after v4.0 and the archival of older more expansive docs aligned with v5.0 guidelines, the link to Cipher_Suites was lost, and later the table became outdated, with the tool to help gather the cipher lists from source not able to automate the parsing anymore.

Nonetheless the page is still linked from outside, and as a part of the recommendations should be kept up-to-date, even if it means manually for now.

There are two major signs the Cipher_Suites page should not be considered abandoned:

  1. After archiving the v4 specs to Security/Archive/Server Side TLS 4.0 the Cipher_Suites page indeed did become orphaned, but not moved to */Archive/* and with no deprecation warning in the page intro, so there's no indication it should be interpreted as unmaintained.
  2. Unlike the archived content that is not included in this repository, the Cipher_Suites.mediawiki page is kept here in master meaning it should still be considered part of the current docs, and kept in sync with the guidelines.

This PR makes the table useful again by:

  • simplifying some of the styling to be more human-friendly for manual edits (while making the output also more readable/accessible due to better contrast),
  • fixing parsing errors for the OpenSSL values used in current configs,
  • updating the color-coding and priority ordering to reflect the current guidelines (v5.7),
  • linking the table from main page and correctly linking the configs back,
  • while removing mentions of automated updates (commented out along with timestamps et al. for now) that are no longer true.
  • (+ as a bonus fixes reported syntax highlighting mediawiki issue by just using <pre/> instead of <source/>…)

This is how the render looks like:

Screen Shot 2024-03-13 at 23 55 37

@janbrasna
Copy link
Author

The table is also being referenced from MDN e.g. https://developer.mozilla.org/en-US/docs/Web/Security/Transport_Layer_Security via the main wiki page, so the link should be there visible, somewhere.

@gstrauss
Copy link

gstrauss commented Nov 7, 2024

Nonetheless the page is still linked from outside, and as a part of the recommendations should be kept up-to-date, even if it means manually for now.

Agreed. Additionally, the color coding consistency in #297 is a desirable update.

@gstrauss
Copy link

gstrauss commented Nov 7, 2024

+Different libraries support different cipher suites and refer to them by different names. Mozilla maintains a list of [[Security/Cipher Suites|all known cipher suites]] and their corresponding names.

"all known cipher suites" might be better phrased as "IANA TLS Cipher Suites"
"and their corresponding names" might be better phrased as "and their corresponding names/identifiers used by different libraries".

Overall, the general tone of the changes looks good to me. I did not verify the manual changes, and will look at #292 to see about fixing the automation.

@janbrasna
Copy link
Author

The automation for --colorize (that reads the actual mediawiki, to alter the existing content, honoring grading and order) seems pretty broken, and the output mapping even for the basic scenarios including some gaps. At some point April mentioned the script served as the basis for the table in its inception, but was managed mostly manually ever since — not sure if the parsing can process the current content at all.

The wording is taken mostly from an archived version; I'll look into improving that.

@@ -73,6 +73,8 @@ Mozilla maintains three recommended configurations for servers using TLS. Pick t
<p style="max-width: 60em;">The ordering of cipher suites in the <span style="color: gray; font-weight: bold;">Old</span> configuration is very important, as it determines the priority with which algorithms are selected.</p>

<p style="max-width: 60em;">OpenSSL will ignore cipher suites it doesn't understand, so always use the full set of cipher suites below, in their recommended order. The use of the <span style="color: gray; font-weight: bold;">Old</span> configuration with modern versions of OpenSSL may require custom builds with support for deprecated ciphers.</p>

<p style="max-width: 60em;">Different libraries support different cipher suites and refer to them by different names. Mozilla maintains a list of [[Security/Cipher Suites|all known cipher suites]] and their corresponding names.</p>
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
<p style="max-width: 60em;">Different libraries support different cipher suites and refer to them by different names. Mozilla maintains a list of [[Security/Cipher Suites|all known cipher suites]] and their corresponding names.</p>
<p style="max-width: 60em;">Different libraries support different cipher suites and refer to them by different names. Mozilla maintains a correspondence table of [[Security/Cipher Suites|cipher suites and their mapping]] to identifiers used by different libraries.</p>

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Cipher_suites table on wiki may no longer be generated automatically, and therefore stale.
2 participants