Show something more useful than the number of bits in the cipher key.

Show something more useful than the number of bits in the cipher key.

For a very long time, the first element in the security section of the
Connection dialog says something like:
  "Your connection to example.com is encrypted with 128-bit encryption"

This is useless because it makes people think that 256 bits must be better than
128. But AES-256-CBC is 256 bits and it's far worse than AES-128-GCM.

Also, we had a different message for when bits <= 80, but we don't support any
of those ciphers any longer so that could never be triggered.

This change switches the message to simply say wheather the cipher suite is
decent or legacy. We use the same judgement function as the one for deciding
whether a TLS connection is acceptable for HTTP/2. Basically, >= TLS 1.2,
forward secure and using an AEAD cipher.

Since this text is two clicks down, users will probably never see it. But I'll
stop being annoyed every time I see the old message.

BUG=none
R=felt@chromium.org

Committed: https://chromium.googlesource.com/chromium/src/+/71c2b59bc4f1c613a88662ebece9180a88125b61

[agl, 2014-11-11 01:34:07]

agl@chromium.org changed reviewers:
+ felt@chromium.org

[felt, 2014-11-12 17:33:18]

lgtm

[agl, 2014-11-12 22:14:37]

The CQ bit was checked by agl@chromium.org

[commit-bot: I haz the power, 2014-11-12 22:16:26]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/703143003/20001

[commit-bot: I haz the power, 2014-11-12 22:22:55]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2014-11-12 22:22:56]

Try jobs failed on following builders:
  chromium_presubmit on tryserver.chromium.linux
(http://build.chromium.org/p/tryserver.chromium.linux/builders/chromium_presub...)

[commit-bot: I haz the power, 2014-11-13 00:36:02]

Patchset 3 (id:??) landed as
https://crrev.com/71c2b59bc4f1c613a88662ebece9180a88125b61
Cr-Commit-Position: refs/heads/master@{#303935}

[agl, 2014-11-13 00:36:06]

Committed patchset #3 (id:40001) manually as
71c2b59bc4f1c613a88662ebece9180a88125b61.

[lgarron, 2014-11-18 06:10:58]

On 2014/11/13 00:36:06, agl wrote:
> Committed patchset #3 (id:40001) manually as
> 71c2b59bc4f1c613a88662ebece9180a88125b61.

So, the cipher bit "strength" is displayed in the full ciphersuite, but this may
not be obvious to everyone. I was about to object that there wasn't a way to
find it for those who (think they) need it, and it took me a while to realize
that it's surfaced as part of the ciphersuite. If you're only looking for "___
bits", you might not notice the cryptic spew of capital letters, underscores and
numbers, or you might not be comfortable assuming that the number in the
ciphersuite is the number that used to go before "bits". (I just did a quick
search, and it seems at least a few sites tell users to look for the phrase "128
bits". Arguably, practically all of those sites are probably outdated, though.)
Server operators might also want to test configs, and be similarly confused at
first.

Perhaps we should just be ready to have a clear answer in case someone
*perceives* that we started hiding information.

But given that the information is available in the ciphersuite, I like the
change. Be as clear and simple as possible, but leave the full details somewhere
for devs. Very Enamely. :-)