• Alex Klyubin's avatar
    Disable static server key ECDH cipher suites in SSLSocket. · 30695d65
    Alex Klyubin authored
    These cipher suites use a static key for ECDH on the server side.
    When client certificates are used, a static key is also used on the
    client side, leading to the same premaster secret for all connections
    between a particular client and server. Also, these cipher suites do
    not provide forward secrecy.
    
    Scans show that removing these cipher suites from the default list
    does not affect connectivity to servers and is thus safe.
    
    Bug: 11220570
    Change-Id: If34f4a3888ed9972c39d171656a85c61dfa98ea1
    30695d65
NativeCrypto.java 50.7 KB