Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

Does anyone know how to set the priority order of SSL/TLS cipher suites on Safari for Mac OSX (10.7 ideally, but any version would be helpful). Can't seem to find any documentation on that point.

share|improve this question
add comment

migrated from security.stackexchange.com Nov 24 '11 at 10:10

This question came from our site for Information security professionals.

1 Answer

Unfortunately, AFAIK, this setting does not exist. (It doesn't exist in another WebKit browser, either: Google Chrome. You can do this in Firefox, though, using 'about:config'.)

About hard-coded cipher priorities/support for the SSL/TLS handshake:

I tested that Safari does not support 40-bit RC4 encryption with an MD5 hash. This means that it does not support some products that are required by US export law to use low (<64-bit) encryption.

See also:

http://www.carbonwind.net/blog/post/A-quick-look-over-some-browsers-and-their-SSLTLS-implementations.aspx

"Initially, in SSL/TLS negotiations, TLS with RSA and weak 128-bit RC4 keys are offered first and second in the cipher order. Worse, ECC (Elliptical Curve Cryptography), AES (Advanced Encryption Standard), and 256-bit keys are never offered as potential cipher choices; further, MD5 is offered first and more frequently than SHA-1, when it should be the other way around."

By Roger A. Grimes, Infoworld Feb 1, 2009 1:19 pm

http://www.pcworld.com/article/158706/how_secure_is_safari.html

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.