What is the correct cipher name for RC4 in Chrome?
I want to remove RC4 from Google Chrome and found the commandline option --cipher-suite-blacklist
. However I wasn't able to figure out what the correct notation for RC4 is. Whatever I tried so far only brought the message:
ERROR:ssl_config_service_manager_pref.cc(55)] Ignoring unrecognized or \
unparsable cipher suite:
Even the names listed in ssl_cipher_suite_names.cc
don't work. What should I enter to remove RC4 as a cipher for SSL/TLS?
I'm working with some different versions of GNU/Linux and sometimes also with Windows. So it would be nice if the command-line argument would work under all OSes. I used the following command:
chrome --cipher-suite-blacklist=TLS_RSA_WITH_RC4_128_MD5 --ssl-version-min=tls1.1
chrome --cipher-suite-blacklist=RC4 --ssl-version-min=tls1.1
chrome --cipher-suite-blacklist=0xXYZ,0xUVW --ssl-version-min=tls1.1 # XYZ and UVW are some hexadecimal numbers
Solution 1:
You must inform the ciphers in hex based in RFC 2246 (http://www.ietf.org/rfc/rfc2246.txt).
The correct command line is:
chrome --cipher-suite-blacklist=0x0004,0x0005,0xc011
No spaces between comma.
Solution 2:
Tiago is right.
However, there are some more ciphers You may want to block: https://www.opensource.apple.com/source/Security/Security-55163.44/libsecurity_ssl/Security/CipherSuite.h?txt
Consequently, you should try this command line:
chrome --cipher-suite-blacklist=0x0001,0x0002,0x0004,0x0005,0x0017,0x0018,0xc002,0xc007,0xc00c,0xc011,0xc016,0xff80,0xff81,0xff82,0xff83
It should block all ciphers using RC4 and/or MD5.