|
 |
90a41a |
diff --git a/Lib/ssl.py b/Lib/ssl.py
|
|
|
90a41a |
index 038daa4..5311321 100644
|
|
|
90a41a |
--- a/Lib/ssl.py
|
|
|
90a41a |
+++ b/Lib/ssl.py
|
|
|
90a41a |
@@ -143,38 +143,36 @@ if _ssl.HAS_TLS_UNIQUE:
|
|
|
90a41a |
else:
|
|
|
90a41a |
CHANNEL_BINDING_TYPES = []
|
|
|
90a41a |
|
|
|
90a41a |
+
|
|
|
90a41a |
# Disable weak or insecure ciphers by default
|
|
|
90a41a |
# (OpenSSL's default setting is 'DEFAULT:!aNULL:!eNULL')
|
|
|
90a41a |
# Enable a better set of ciphers by default
|
|
|
90a41a |
# This list has been explicitly chosen to:
|
|
|
90a41a |
# * Prefer cipher suites that offer perfect forward secrecy (DHE/ECDHE)
|
|
|
90a41a |
# * Prefer ECDHE over DHE for better performance
|
|
|
90a41a |
-# * Prefer any AES-GCM over any AES-CBC for better performance and security
|
|
|
90a41a |
+# * Prefer AEAD over CBC for better performance and security
|
|
|
90a41a |
# * Then Use HIGH cipher suites as a fallback
|
|
|
90a41a |
-# * Then Use 3DES as fallback which is secure but slow
|
|
|
90a41a |
# * Finally use RC4 as a fallback which is problematic but needed for
|
|
|
90a41a |
# compatibility some times.
|
|
|
90a41a |
-# * Disable NULL authentication, NULL encryption, and MD5 MACs for security
|
|
|
90a41a |
-# reasons
|
|
|
90a41a |
+# * Disable NULL authentication, NULL encryption, 3DES and MD5 MACs
|
|
|
90a41a |
+# for security reasons
|
|
|
90a41a |
_DEFAULT_CIPHERS = (
|
|
|
90a41a |
'ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+HIGH:'
|
|
|
90a41a |
- 'DH+HIGH:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+HIGH:RSA+3DES:ECDH+RC4:'
|
|
|
90a41a |
- 'DH+RC4:RSA+RC4:!aNULL:!eNULL:!MD5'
|
|
|
90a41a |
+ 'DH+HIGH:RSA+AESGCM:RSA+AES:RSA+HIGH:ECDH+RC4:DH+RC4:RSA+RC4:!aNULL:!eNULL:'
|
|
|
90a41a |
+ '!MD5:!3DES'
|
|
|
90a41a |
)
|
|
|
90a41a |
|
|
|
90a41a |
# Restricted and more secure ciphers for the server side
|
|
|
90a41a |
# This list has been explicitly chosen to:
|
|
|
90a41a |
# * Prefer cipher suites that offer perfect forward secrecy (DHE/ECDHE)
|
|
|
90a41a |
# * Prefer ECDHE over DHE for better performance
|
|
|
90a41a |
-# * Prefer any AES-GCM over any AES-CBC for better performance and security
|
|
|
90a41a |
+# * Prefer AEAD over CBC for better performance and security
|
|
|
90a41a |
# * Then Use HIGH cipher suites as a fallback
|
|
|
90a41a |
-# * Then Use 3DES as fallback which is secure but slow
|
|
|
90a41a |
-# * Disable NULL authentication, NULL encryption, MD5 MACs, DSS, and RC4 for
|
|
|
90a41a |
-# security reasons
|
|
|
90a41a |
+# * Disable NULL authentication, NULL encryption, MD5 MACs, DSS, RC4, and
|
|
|
90a41a |
+# 3DES for security reasons
|
|
|
90a41a |
_RESTRICTED_SERVER_CIPHERS = (
|
|
|
90a41a |
'ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+HIGH:'
|
|
|
90a41a |
- 'DH+HIGH:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+HIGH:RSA+3DES:!aNULL:'
|
|
|
90a41a |
- '!eNULL:!MD5:!DSS:!RC4'
|
|
|
90a41a |
+ 'DH+HIGH:RSA+AESGCM:RSA+AES:RSA+HIGH:!aNULL:!eNULL:!MD5:!DSS:!RC4:!3DES'
|
|
|
90a41a |
)
|
|
|
90a41a |
|
|
|
90a41a |
|