ARCFOUR-128 is disabled by default

diff --git a/doc/cha-gtls-app.texi b/doc/cha-gtls-app.texi
index 615da051d12b0f8ead29738bf891a3cfe26bc27a..7540a7dd313682e5a48c64fb7fcbcc30f7339f81 100644 (file)
--- a/doc/cha-gtls-app.texi
+++ b/doc/cha-gtls-app.texi
@@ -922,7 +922,7 @@ Means that a compile-time specified system configuration file@footnote{The defau
 will be used to expand the provided keyword. That is used to impose system-specific policies.
 It may be followed by additional options that will be appended to the
 system string (e.g., "@@SYSTEM:+SRP"). The system file should have the
-format 'KEYWORD=VALUE', e.g., 'SYSTEM=NORMAL:-ARCFOUR-128'.
+format 'KEYWORD=VALUE', e.g., 'SYSTEM=NORMAL:+ARCFOUR-128'.
 
 @item PERFORMANCE @tab
 All the known to be secure ciphersuites are enabled,
@@ -1031,7 +1031,7 @@ appended with an algorithm will add this algorithm.
 @headitem Type @tab Keywords
 @item Ciphers @tab
 AES-128-CBC, AES-256-CBC, AES-128-GCM, CAMELLIA-128-CBC,
-CAMELLIA-256-CBC, ARCFOUR-128, 3DES-CBC ARCFOUR-40. Catch all
+CAMELLIA-256-CBC, ARCFOUR-128, 3DES-CBC. Catch all
 name is CIPHER-ALL which will add all the algorithms from NORMAL
 priority.
 
@@ -1205,8 +1205,8 @@ The default priority without the HMAC-MD5:
 Specifying RSA with AES-128-CBC:
     "NONE:+VERS-TLS-ALL:+MAC-ALL:+RSA:+AES-128-CBC:+SIGN-ALL:+COMP-NULL"
 
-Specifying the defaults except ARCFOUR-128:
-    "NORMAL:-ARCFOUR-128"
+Specifying the defaults plus ARCFOUR-128:
+    "NORMAL:+ARCFOUR-128"
 
 Enabling the 128-bit secure ciphers, while disabling TLS 1.0 and enabling compression:
     "SECURE128:-VERS-TLS1.0:+COMP-DEFLATE"

diff --git a/doc/cha-intro-tls.texi b/doc/cha-intro-tls.texi
index 0bc02ed589d662246fe82bc9bacc442c07f9d570..6a15b0febf1cf097ebba69808ef2aeedf6b30256 100644 (file)
--- a/doc/cha-intro-tls.texi
+++ b/doc/cha-intro-tls.texi
@@ -122,7 +122,7 @@ encryption (EDE). Has 64 bits block size and is used in CBC mode.
 
 @item ARCFOUR_@-128 @tab
 ARCFOUR_128 is a compatible algorithm with RSA's RC4 algorithm, which is considered to be a trade
-secret. It is a fast cipher but considered weak today.
+secret. It is a fast cipher but considered weak today, and thus it is not enabled by default.
 
 @item AES_@-CBC @tab
 AES or RIJNDAEL is the block cipher algorithm that replaces the old

diff --git a/lib/gnutls_priority.c b/lib/gnutls_priority.c
index 21dd22a871188768653fcf21a3291ba827414813..95159366fd52e8c0408ebaf3fccbe7c3974f0559 100644 (file)
--- a/lib/gnutls_priority.c
+++ b/lib/gnutls_priority.c
@@ -230,7 +230,6 @@ static const int _kx_priority_secure[] = {
 static const int* kx_priority_secure = _kx_priority_secure;
 
 static const int _cipher_priority_performance_default[] = {
-       GNUTLS_CIPHER_ARCFOUR_128,
        GNUTLS_CIPHER_AES_128_GCM,
        GNUTLS_CIPHER_AES_256_GCM,
        GNUTLS_CIPHER_CAMELLIA_128_GCM,
@@ -260,7 +259,6 @@ static const int _cipher_priority_normal_default[] = {
        GNUTLS_CIPHER_AES_128_CCM,
        GNUTLS_CIPHER_AES_256_CCM,
        GNUTLS_CIPHER_3DES_CBC,
-       GNUTLS_CIPHER_ARCFOUR_128,
        0
 };
 
@@ -1012,7 +1010,7 @@ finish:
  * /etc/gnutls/default-priorities. Any keywords that follow it, will 
  * be appended to the expanded string. If there is no system string,
  * then the function will fail. The system file should be formatted
- * as "KEYWORD=VALUE", e.g., "SYSTEM=NORMAL:-ARCFOUR-128".
+ * as "KEYWORD=VALUE", e.g., "SYSTEM=NORMAL:+ARCFOUR-128".
  *
  * Special keywords are "!", "-" and "+".
  * "!" or "-" appended with an algorithm will remove this algorithm.
@@ -1025,7 +1023,7 @@ finish:
  *
  * "NONE:+VERS-TLS-ALL:+MAC-ALL:+RSA:+AES-128-CBC:+SIGN-ALL:+COMP-NULL"
  *
- * "NORMAL:-ARCFOUR-128" means normal ciphers except for ARCFOUR-128.
+ * "NORMAL:+ARCFOUR-128" means normal ciphers plus ARCFOUR-128.
  *
  * "SECURE128:-VERS-SSL3.0:+COMP-DEFLATE" means that only secure ciphers are
  * enabled, SSL3.0 is disabled, and libz compression enabled.