Skip to content

Support bracketed equal-preference groups in SSL[_CTX]_set_cipher_list #541

@rcombs

Description

@rcombs

BoringSSL implemented this in https://boringssl.googlesource.com/boringssl/+/858a88daf27975f67d9f63e18f95645be2886bfb
This allows a server consumer to specify multiple cipher suites at the same level of preference, so the server can enable SSL_OP_CIPHER_SERVER_PREFERENCE, but also take the client's preferences into account when selecting one of several ciphers that are all equally preferred.
The upshot, as described in that BoringSSL commit message, is that the server can prefer AES-GCM and ChaCha20 equally. Android devices without hardware AES support put ChaCha20 first in their suite preference list, so with this feature, the server could select AES-GCM for clients with hardware support and ChaCha20 for ones without it, which optimizes performance for both cases.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions