Expose TLS settings in the Security panel overview, and call out individual obsolete settings.

chrome/app/generated_resources.grd

Index: chrome/app/generated_resources.grd
diff --git a/chrome/app/generated_resources.grd b/chrome/app/generated_resources.grd
index ca6694955b36dc2dccba9bd451af5cc9276604a8..839cc78d883429750c7a59be940d779921c79819 100644
--- a/chrome/app/generated_resources.grd
+++ b/chrome/app/generated_resources.grd
@@ -14338,11 +14338,41 @@ Please check your email at <ph name="ACCOUNT_EMAIL">$2<ex>jane.doe@gmail.com</ex
       <message name="IDS_VALID_SERVER_CERTIFICATE_DESCRIPTION" desc="Description of a site that has a valid server certificate." translateable="false">
         The connection to this site is using a valid, trusted server certificate.
       </message>
-      <message name="IDS_SECURE_PROTOCOL_AND_CIPHERSUITE" desc="Summary phrase for a site that uses a modern, secure TLS protocol version and ciphersuite." translateable="false">
+      <message name="IDS_SECURE_PROTOCOL_AND_CIPHERSUITE" desc="Summary phrase for a site that uses a modern, secure TLS protocol and ciphersuite." translateable="false">
         Secure TLS connection
       </message>
-      <message name="IDS_SECURE_PROTOCOL_AND_CIPHERSUITE_DESCRIPTION" desc="Description of a site that uses a modern, secure TLS protocol version and ciphersuite." translateable="false">
-        The connection to this site is using a strong protocol version and cipher suite.
+      <message name="IDS_SECURE_PROTOCOL_AND_CIPHERSUITE_DESCRIPTION" desc="Description of a site that uses a modern, secure TLS protocol and ciphersuite." translateable="false">
+        The connection to this site is encrypted and authenticated using a strong protocol (<ph name="PROTOCOL_VERSION">$1<ex>TLS 1.2</ex></ph>), key exchange (<ph name="KEY_EXCHANGE">$2<ex>ECDHE_RSA</ex></ph>), and cipher suite (<ph name="CIPHER_SUTE">$3<ex>AES_128_GCM</ex></ph>).

[lgarron, 2016/04/09 03:22:50]

I'm referring to "TLS", but the connection might actually be QUIC. Do you think
it's okay to gloss over that detail?

[davidben, 2016/04/11 16:47:01]

*shrug* The description string doesn't end up in the UI anyway.

[lgarron, 2016/04/12 02:25:07]

I'm not sure what you mean. It shows up in the first screenshot at
https://crbug.com/551728#c16 (for www.google.com).

[davidben, 2016/04/19 17:47:01]

Oh, I see. Why not "Secure connection"? I don't terribly mind "Secure TLS
connection" for QUIC, but I'm sure someone will file a bug for you here (just
like all the "however" stuff was just asking for reports), and the rest of the
UI just says "connection". ("Your connection to this site is private", etc.)

+      </message>
+      <message name="IDS_CIPHERSUITE_WITH_MAC" desc="Description of a cipher suite that contains a seperate cipher and MAC." translateable="false">
+        <ph name="CIPHER">$1<ex>AES_256_CBC</ex></ph> with <ph name="MAC">$2<ex>HMAC-SHA1</ex></ph>
+      </message>
+      <message name="IDS_SINGLE_OBSOLETE_TLS_SETTING" desc="Summary phrase for a site that uses an outdated TLS protocol, key exchange, or ciphersuite." translateable="false">
+        Obsolete TLS <ph name="SETTING">$1<ex>protocol</ex></ph>
+      </message>
+      <message name="IDS_TWO_OBSOLETE_TLS_SETTINGS" desc="Summary phrase for a site that uses two of an outdated TLS protocol, key exchange, or ciphersuite." translateable="false">

[davidben, 2016/04/11 16:47:01]

Nit: you say ciphersuite sometimes and cipher suite other times.

[lgarron, 2016/04/12 02:25:07]

Good catch, fixed.

(I used to write "ciphersuite" and recently switched to "cipher suite", but I'm
still getting used to the more popular usage.)

+        Obsolete TLS <ph name="FIRST_SETTING">$1<ex>protocol</ex></ph> and <ph name="SECOND_SETTING">$2<ex>cipher suite</ex></ph>

[davidben, 2016/04/11 16:47:01]

cipher suite -> bulk cipher or maybe just "cipher". "cipher suite" refers to the
entire combination. (Hence "suite".) Ditto elsewhere.

[lgarron, 2016/04/12 02:25:07]

The origin view in the Security panel say "Cipher Suite" rather than "Cipher".
I'd like this to be consistent. Would you prefer to change both to "Cipher"?

[davidben, 2016/04/19 17:47:01]

Yeah, let's change them both to "cipher". "Cipher suite" is a very specific
TLS-specific notion. We shouldn't muddy the waters by using it for the AEAD /
bulk cipher + MAC.
https://en.wikipedia.org/wiki/Cipher_suite

+      </message>
+      <message name="IDS_THREE_OBSOLETE_TLS_SETTINGS" desc="Summary phrase for a site that uses an outdated TLS protocol, key exchange, and ciphersuite" translateable="false">
+        Obsolete TLS settings
+      </message>
+      <message name="IDS_SSL_PROTOCOL" desc="The word to describe a TLS protocol." translateable="false">
+        protocol
+      </message>
+      <message name="IDS_SSL_KEY_EXCHANGE" desc="The word to describe a TLS key exchange." translateable="false">
+        key exchange
+      </message>
+      <message name="IDS_SSL_CIPHER_SUITE" desc="The word to describe a TLS cipher suite." translateable="false">
+        cipher suite
+      </message>
+      <message name="IDS_SSL_AN_OBSOLETE" desc="The article and adjective used to describe an obsolete TLS setting." translateable="false">
+        an obsolete
+      </message>
+      <message name="IDS_SSL_A_MODERN" desc="The article and adjective used to describe a modern TLS setting." translateable="false">
+        a modern
+      </message>
+      <message name="IDS_OBSOLETE_SSL_DESCRIPTION" desc="Description of a site that uses an outdated TLS protocol or ciphersuite." translateable="false">
+        The connection to this site uses <ph name="AN_OBSOLETE_OR_A_MODERN_PROTOCOL">$1<ex>an obsolete</ex></ph> protocol (<ph name="PROTOCOL">$2<ex>TLS 1.0</ex></ph>), <ph name="AN_OBSOLETE_OR_A_MODERN_KEY_EXCHANGE">$3<ex>an obsolete</ex></ph> key exchange (<ph name="KEY_EXCHANGE">$4<ex>ECDHE_RSA</ex></ph>), and <ph name="AN_OBSOLETE_OR_A_MODERN_CIPHER_SUITE">$5<ex>an obsolete</ex></ph> cipher suite (<ph name="CIPHER_SUITE">$6<ex>AES_256_CBC with HMAC-SHA1</ex></ph>).
       </message>
       <message name="IDS_SAVE_PASSWORD_DIFFERENT_DOMAINS_TITLE" desc="The title of the save password bubble when the submitted form origin isn't equal to the page origin.">
         Do you want <ph name="PASSWORD_MANAGER_BRAND">$1<ex>Google Chrome</ex></ph> to save your password for <ph name="ORIGIN">$2<ex>example.com</ex></ph>?