Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

crypto/tls: ambiguous comment in cipher_suites.go #14474

Closed
d1str0 opened this issue Feb 22, 2016 · 1 comment
Closed

crypto/tls: ambiguous comment in cipher_suites.go #14474

d1str0 opened this issue Feb 22, 2016 · 1 comment
Labels
FrozenDueToAge

Comments

@d1str0
Copy link
Contributor

d1str0 commented Feb 22, 2016

https://github.com/golang/go/blob/master/src/crypto/tls/cipher_suites.go#L77

This line says "RC4 comes before AES (because of the Lucky13 attack)" when it should be clarified that AES-GCM is safe and therefore preferred over RC4.
@d1str0
Copy link
Contributor Author

d1str0 commented Feb 22, 2016

https://go-review.googlesource.com/#/c/19845/

@golang golang locked and limited conversation to collaborators Feb 28, 2017
FiloSottile pushed a commit to FiloSottile/go that referenced this issue Oct 12, 2018
@d1str0 @bradfitz
crypto/tls: Improve ambiguous comment in cipher_suites.go
ead827c 
A comment existed referencing RC4 coming before AES because of it's
vulnerability to the Lucky 13 attack. This clarifies that the Lucky 13 attack
only effects AES-CBC, and not AES-GCM.

Fixes golang#14474

Change-Id: Idcb07b5e0cdb0f9257cf75abea60129ba495b5f5
Reviewed-on: https://go-review.googlesource.com/19845
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
FiloSottile pushed a commit to FiloSottile/go that referenced this issue Oct 12, 2018
@d1str0 @bradfitz
crypto/tls: Improve ambiguous comment in cipher_suites.go
fd1ada0 
A comment existed referencing RC4 coming before AES because of it's
vulnerability to the Lucky 13 attack. This clarifies that the Lucky 13 attack
only effects AES-CBC, and not AES-GCM.

Fixes golang#14474

Change-Id: Idcb07b5e0cdb0f9257cf75abea60129ba495b5f5
Reviewed-on: https://go-review.googlesource.com/19845
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
FrozenDueToAge
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@d1str0 @gopherbot