From: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Date: Wed, 31 Dec 2014 20:40:55 +0000 (+0200)
Subject: ARCFOUR-128 is disabled by default
X-Git-Tag: gnutls_3_4_0~403
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=93658370714132cd7fac931ca72922f0b28dea54;p=thirdparty%2Fgnutls.git

ARCFOUR-128 is disabled by default
---

diff --git a/doc/cha-gtls-app.texi b/doc/cha-gtls-app.texi
index 615da051d1..7540a7dd31 100644
--- a/doc/cha-gtls-app.texi
+++ b/doc/cha-gtls-app.texi
@@ -922,7 +922,7 @@ Means that a compile-time specified system configuration file@footnote{The defau
 will be used to expand the provided keyword. That is used to impose system-specific policies.
 It may be followed by additional options that will be appended to the
 system string (e.g., "@@SYSTEM:+SRP"). The system file should have the
-format 'KEYWORD=VALUE', e.g., 'SYSTEM=NORMAL:-ARCFOUR-128'.
+format 'KEYWORD=VALUE', e.g., 'SYSTEM=NORMAL:+ARCFOUR-128'.
 
 @item PERFORMANCE @tab
 All the known to be secure ciphersuites are enabled,
@@ -1031,7 +1031,7 @@ appended with an algorithm will add this algorithm.
 @headitem Type @tab Keywords
 @item Ciphers @tab
 AES-128-CBC, AES-256-CBC, AES-128-GCM, CAMELLIA-128-CBC,
-CAMELLIA-256-CBC, ARCFOUR-128, 3DES-CBC ARCFOUR-40. Catch all
+CAMELLIA-256-CBC, ARCFOUR-128, 3DES-CBC. Catch all
 name is CIPHER-ALL which will add all the algorithms from NORMAL
 priority.
 
@@ -1205,8 +1205,8 @@ The default priority without the HMAC-MD5:
 Specifying RSA with AES-128-CBC:
     "NONE:+VERS-TLS-ALL:+MAC-ALL:+RSA:+AES-128-CBC:+SIGN-ALL:+COMP-NULL"
 
-Specifying the defaults except ARCFOUR-128:
-    "NORMAL:-ARCFOUR-128"
+Specifying the defaults plus ARCFOUR-128:
+    "NORMAL:+ARCFOUR-128"
 
 Enabling the 128-bit secure ciphers, while disabling TLS 1.0 and enabling compression:
     "SECURE128:-VERS-TLS1.0:+COMP-DEFLATE"
diff --git a/doc/cha-intro-tls.texi b/doc/cha-intro-tls.texi
index 0bc02ed589..6a15b0febf 100644
--- a/doc/cha-intro-tls.texi
+++ b/doc/cha-intro-tls.texi
@@ -122,7 +122,7 @@ encryption (EDE). Has 64 bits block size and is used in CBC mode.
 
 @item ARCFOUR_@-128 @tab
 ARCFOUR_128 is a compatible algorithm with RSA's RC4 algorithm, which is considered to be a trade
-secret. It is a fast cipher but considered weak today.
+secret. It is a fast cipher but considered weak today, and thus it is not enabled by default.
 
 @item AES_@-CBC @tab
 AES or RIJNDAEL is the block cipher algorithm that replaces the old
diff --git a/lib/gnutls_priority.c b/lib/gnutls_priority.c
index 21dd22a871..95159366fd 100644
--- a/lib/gnutls_priority.c
+++ b/lib/gnutls_priority.c
@@ -230,7 +230,6 @@ static const int _kx_priority_secure[] = {
 static const int* kx_priority_secure = _kx_priority_secure;
 
 static const int _cipher_priority_performance_default[] = {
-	GNUTLS_CIPHER_ARCFOUR_128,
 	GNUTLS_CIPHER_AES_128_GCM,
 	GNUTLS_CIPHER_AES_256_GCM,
 	GNUTLS_CIPHER_CAMELLIA_128_GCM,
@@ -260,7 +259,6 @@ static const int _cipher_priority_normal_default[] = {
 	GNUTLS_CIPHER_AES_128_CCM,
 	GNUTLS_CIPHER_AES_256_CCM,
 	GNUTLS_CIPHER_3DES_CBC,
-	GNUTLS_CIPHER_ARCFOUR_128,
 	0
 };
 
@@ -1012,7 +1010,7 @@ finish:
  * /etc/gnutls/default-priorities. Any keywords that follow it, will 
  * be appended to the expanded string. If there is no system string,
  * then the function will fail. The system file should be formatted
- * as "KEYWORD=VALUE", e.g., "SYSTEM=NORMAL:-ARCFOUR-128".
+ * as "KEYWORD=VALUE", e.g., "SYSTEM=NORMAL:+ARCFOUR-128".
  *
  * Special keywords are "!", "-" and "+".
  * "!" or "-" appended with an algorithm will remove this algorithm.
@@ -1025,7 +1023,7 @@ finish:
  *
  * "NONE:+VERS-TLS-ALL:+MAC-ALL:+RSA:+AES-128-CBC:+SIGN-ALL:+COMP-NULL"
  *
- * "NORMAL:-ARCFOUR-128" means normal ciphers except for ARCFOUR-128.
+ * "NORMAL:+ARCFOUR-128" means normal ciphers plus ARCFOUR-128.
  *
  * "SECURE128:-VERS-SSL3.0:+COMP-DEFLATE" means that only secure ciphers are
  * enabled, SSL3.0 is disabled, and libz compression enabled.