Remove DHE.

components/policy/resources/policy_templates.json

Index: components/policy/resources/policy_templates.json
diff --git a/components/policy/resources/policy_templates.json b/components/policy/resources/policy_templates.json
index e3cf5f6091b68f2c096a746e2adcd6aea3d5c489..b2bbdbdffd0129310e09969530fda6c6a58f97cd 100644
--- a/components/policy/resources/policy_templates.json
+++ b/components/policy/resources/policy_templates.json
@@ -137,7 +137,7 @@
 #   persistent IDs for all fields (but not for groups!) are needed. These are
 #   specified by the 'id' keys of each policy. NEVER CHANGE EXISTING IDs,
 #   because doing so would break the deployed wire format!
-#   For your editing convenience: highest ID currently used: 333
+#   For your editing convenience: highest ID currently used: 334
 #
 # Placeholders:
 #   The following placeholder strings are automatically substituted:
@@ -7942,6 +7942,30 @@
       If the policy is not set, or is set to false, then RC4 cipher suites in TLS will not be enabled. Otherwise it may be set to true to retain compatibility with an outdated server. This is a stopgap measure and the server should be reconfigured.''',
     },
     {
+      'name': 'DHEEnabled',
+      'type': 'main',
+      'schema': {
+        'type': 'boolean',
+      },
+      'supported_on': [
+        'chrome.*:53-57',
+        'chrome_os:53-57',
+        'android:53-57',
+        'ios:53-57',
+      ],
+      'features': {
+        'dynamic_refresh': True,
+        'per_profile': False,
+      },
+      'example_value': False,
+      'id': 334,
+      'caption': '''Whether DHE cipher suites in TLS are enabled''',
+      'tags': ['system-security'],
+      'desc': '''Warning: DHE will be completely removed from <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> after version 57 (around March 2017) and this policy will stop working then.
+
+      If the policy is not set, or is set to false, then DHE cipher suites in TLS will not be enabled. Otherwise it may be set to true to retain compatibility with an outdated server. This is a stopgap measure and the server should be reconfigured.''',

[Thiemo Nagel, 2016/06/21 12:23:23]

Nit: Present tense is better style in my opinion.
Nit: "Otherwise ..." should mirror the "false" wording and spell out explicitly
what happens in the "true" case, i.e. DHE being enabled.
Nit: It would be nice to point to docs explaining why DHE should not be used
anymore.

[davidben, 2016/06/22 04:18:19]

Which part? Do you mean "If the policy [...], then DHE cipher suites in TLS are
not enabled"? That reads a little off to me.
Done.
Hrm. So, I added a sentence about what servers should do instead. Why DHE
shouldn't be used is... complicated. There's some info here:
https://www.chromestatus.com/feature/5128908798164992
https://groups.google.com/a/chromium.org/d/msg/blink-dev/AAdv838-koo/bJv17voI...
https://groups.google.com/a/chromium.org/d/msg/blink-dev/ShRaCsYx4lk/46rD81As...

The only detailed info is in the Intent threads. I feel a little silly linking
to blink-dev in here though. Thoughts? I imagine later there will be something
on https://developers.google.com/web/updates/, but that text gets written after
branch point, not before.

[davidben, 2016/06/23 22:05:34]

(Urf, apparently you're OOO for a bit. I'll go ahead and land this now to get
the ball rolling. If you want me to tweak the text further when you get back,
let me know and I'll upload a follow-up.)

+    },
+    {
       'name': 'ContextualSearchEnabled',
       'type': 'main',
       'schema': { 'type': 'boolean' },