IsSecureTLSCipherSuite should not classify DHE_RSA as secure.

IsSecureTLSCipherSuite should not classify DHE_RSA as secure.

This makes the requirements for 'modern' ECDHE + AEAD, rather than PFS + AEAD.
Given that we'd been hoping to ditch DHE for a while, we should at least get it
out of the modern bucket.

The HTTP/2 requirements stay the same since those are snapshotted into the spec
already. Though early data says that no one uses HTTP/2 with DHE_RSA, which is
good for removal prospects.

BUG=538690
Committed: https://crrev.com/2937efc4b3cd071db278cbbe3c47c67d8567ec74
Cr-Commit-Position: refs/heads/master@{#356000}

[davidben, 2015-10-16 21:39:18]

davidben@chromium.org changed reviewers:
+ agl@chromium.org, felt@chromium.org, rsleevi@chromium.org

[davidben, 2015-10-16 21:39:19]

Just realized that the little descriptor in the UI is pretty inconsistent with
what we hope to do with DHE.

https://codereview.chromium.org/1405383003/diff/1/net/ssl/ssl_cipher_suite_na...
File net/ssl/ssl_cipher_suite_names_unittest.cc (left):

https://codereview.chromium.org/1405383003/diff/1/net/ssl/ssl_cipher_suite_na...
net/ssl/ssl_cipher_suite_names_unittest.cc:79:
EXPECT_TRUE(IsSecureTLSCipherSuite(0xcc15));
(0xcc15 is the non-standard DHE_RSA CHACHA20_POLY1305 cipher. Neither BoringSSL
or NSS supports it at all now.)

[Ryan Sleevi, 2015-10-16 21:40:36]

lgtm

[davidben, 2015-10-16 21:54:30]

felt: Since it looks like you'll be back next week, I'll wait for you to say
something before landing it, just to make sure you won't hate me for it. (All
this changes is the modern vs obsolete categorization of
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256.)

[agl, 2015-10-16 21:59:35]

lgtm

[davidben, 2015-10-22 22:48:49]

felt: friendly ping

[felt, 2015-10-25 03:15:03]

On 2015/10/22 22:48:49, davidben (OOO 10-21 to 10-23) wrote:
> felt: friendly ping

sorry for the delay, i came back for a half second before promptly going ooo
again. :)

lgtm.

[felt, 2015-10-25 03:15:50]

Description was changed from

==========
IsSecureTLSCipherSuite should not classify DHE_RSA as secure.

This makes the requirements for 'modern' ECDHE + AEAD, rather than PFS + AEAD.
Given that we'd been hoping to ditch DHE for a while, we should at least get it
out of the modern bucket.

The HTTP/2 requirements stay the same since those are snapshotted into the spec
already. Though early data says that no one uses HTTP/2 with DHE_RSA, which is
good for removal prospects.

BUG=538690
==========

to

==========
IsSecureTLSCipherSuite should not classify DHE_RSA as secure.

This makes the requirements for 'modern' ECDHE + AEAD, rather than PFS + AEAD.
Given that we'd been hoping to ditch DHE for a while, we should at least get it
out of the modern bucket.

The HTTP/2 requirements stay the same since those are snapshotted into the spec
already. Though early data says that no one uses HTTP/2 with DHE_RSA, which is
good for removal prospects.

BUG=538690
==========

[felt, 2015-10-25 03:16:00]

+cc lgarron as fyi

[davidben, 2015-10-25 16:46:24]

The CQ bit was checked by davidben@chromium.org

[commit-bot: I haz the power, 2015-10-25 16:46:39]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1405383003/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1405383003/1

[commit-bot: I haz the power, 2015-10-25 18:22:09]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-10-25 18:22:10]

Try jobs failed on following builders:
  linux_android_rel_ng on tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_android_r...)

[davidben, 2015-10-25 20:16:07]

The CQ bit was checked by davidben@chromium.org

[commit-bot: I haz the power, 2015-10-25 20:16:26]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1405383003/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1405383003/1

[commit-bot: I haz the power, 2015-10-26 00:56:26]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2015-10-26 00:57:51]

Patchset 1 (id:??) landed as
https://crrev.com/2937efc4b3cd071db278cbbe3c47c67d8567ec74
Cr-Commit-Position: refs/heads/master@{#356000}