tls use crypto std cipher suites #2510
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
p4gefau1t
reviewed
May 31, 2020
| tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, | ||
| tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, | ||
| tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, | ||
| // use tls cipher suites from cryto/tls |
There was a problem hiding this comment.
这里应该简单地传入nil，让TLS库使用defaultCipherSuites()初始化CipherSuites列表，而不是把tls支持的所有CipherSuites传入。go的tls库默认情况下并不会使用所有的CipherSuites，这样做等于引入了新的特征码。
There was a problem hiding this comment.
默认的 CipherSuites 会不会也成特征？要不要从最流行的 Hello Cipher Suites里面挑/随机选?
|
经过最新 master 分支抓包实验，这个 PR 确实规避了15个硬编码 Ciphers 的问题 V2ray 流量
OwnCloud 流量
微信内置网页浏览器流量
百度家族流量
Tim 流量
如图所示，patch 过后的 V2ray-Core 使用了 19 个 Ciphers，这些 Ciphers 对比当前 Firefox/Chrome/Edge 的 TLS 流量，Ciphers 顺序有肉眼可见的排序特征 此外，经过简单统计，Owncloud（Qt），Firefox，Chromium 不会将 RSA 系列加密套件放到椭圆曲线之前 |
|
@Qv2ray-dev 这是不同 TLS 库的差异，如果要以此为特征进行封锁，会误伤大量用 golang 编写的正常应用吧。 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.