net: only False Start with forward secret servers.

net: only False Start with forward secret servers.

Bodo made the point that we originally sacrificed an aspect of forward secrecy
in order to use False Start widely. Specifically, an attacker can alter the
handshake and cause a non-forward secure ciphersuite to be selected and the
client's initial write will not be forward secret.

Since we are no longer trying to use False Start everywhere, we can close that
gap by only allowing it for forward secret connections.

This change also addresses follow up comments on
https://chromiumcodereview.appspot.com/10014010/ and adds the patch file that
was missing in that change.

BUG=none
TEST=net_unittests


Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=133255

[wtc, 2012-04-19 22:33:53]

Patch set 1 LGTM.  Note my suggested change below.

https://chromiumcodereview.appspot.com/10136001/diff/1/net/third_party/nss/ss...
File net/third_party/nss/ssl/ssl3con.c (right):

https://chromiumcodereview.appspot.com/10136001/diff/1/net/third_party/nss/ss...
net/third_party/nss/ssl/ssl3con.c:6092: ss->ssl3.hs.kea_def->exchKeyType ==
ssl_kea_ecdh);

It would be nice to add a comment to briefly explain why
only certain key exchange algorithms are compatible with
False Start.

IMPORTANT: Looking at this more closely, I think we're testing the wrong
member of ss->ssl3.hs.kea_def here.

I assume we don't want to enable False Start with the
non-ephemeral DH and ECDH cipher suites such as
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA.  If so, we should
be testing
  ss->ssl3.hs.kea_def->kea == kea_dhe_dss ||
  ss->ssl3.hs.kea_def->kea == kea_dhe_rsa ||
  ss->ssl3.hs.kea_def->kea == kea_ecdhe_ecdsa ||
  ss->ssl3.hs.kea_def->kea == kea_ecdhe_rsa

See
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/security/nss/lib/ssl/ssl3...

and http://mxr.mozilla.org/security/ident?i=kea_ecdhe_rsa

[agl, 2012-04-20 18:30:29]

https://chromiumcodereview.appspot.com/10136001/diff/1/net/third_party/nss/ss...
File net/third_party/nss/ssl/ssl3con.c (right):

https://chromiumcodereview.appspot.com/10136001/diff/1/net/third_party/nss/ss...
net/third_party/nss/ssl/ssl3con.c:6092: ss->ssl3.hs.kea_def->exchKeyType ==
ssl_kea_ecdh);
On 2012/04/19 22:33:53, wtc wrote:
> It would be nice to add a comment to briefly explain why
> only certain key exchange algorithms are compatible with
> False Start.

Done.

> IMPORTANT: Looking at this more closely, I think we're testing the wrong
> member of ss->ssl3.hs.kea_def here.

Thanks! Done.

[commit-bot: I haz the power, 2012-04-20 18:30:41]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/agl@chromium.org/10136001/4001

[commit-bot: I haz the power, 2012-04-20 20:28:28]

Change committed as 133255