Re: [go-nuts] Client Cipher Order Preference not being honored with golang 1.17+

2022-08-29 Thread 'Diana Tuck' via golang-nuts
roups.com> wrote: > >> Given that Lucky 13 and other CBC attacks are more real (common, >> practical), Go's decision to lower their priority didn't seem unreasonable. >> >> Collapsing a multi dimensional protocol into an ordering requires some >> valu

Re: [go-nuts] Client Cipher Order Preference not being honored with golang 1.17+

2022-08-25 Thread 'Diana Tuck' via golang-nuts
; This is intentional, see https://go.dev/issue/45430 >> >> - sean >> >> On Thu, Aug 25, 2022, 19:07 'Diana Tuck' via golang-nuts < >> golan...@googlegroups.com> wrote: >> >>> Since upgrading to 1.17 in which the cipher order is determ

Re: [go-nuts] Client Cipher Order Preference not being honored with golang 1.17+

2022-08-25 Thread &#x27;Diana Tuck&#x27; via golang-nuts
> > - sean > > On Thu, Aug 25, 2022, 19:07 'Diana Tuck' via golang-nuts < > golang-nuts@googlegroups.com> wrote: > >> Since upgrading to 1.17 in which the cipher order is determined by the >> golang lib, clients that previously negotiated with more secur

[go-nuts] Client Cipher Order Preference not being honored with golang 1.17+

2022-08-25 Thread &#x27;Diana Tuck&#x27; via golang-nuts
Since upgrading to 1.17 in which the cipher order is determined by the golang lib, clients that previously negotiated with more secure ciphers are now using less secure ciphers. We see that Windows 7 and 8 clients can no longer negotiate using xc027 and are instead using 0x9c, which is lower i