Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want to remove RC4 from Google Chrome and found the commandline option --cipher-suite-blacklist. However I wasn't able to figure out what the correct notation for RC4 is. Whatever I tried so far only brought the message:

ERROR:ssl_config_service_manager_pref.cc(55)] Ignoring unrecognized or \
  unparsable cipher suite: 

Even the names listed in ssl_cipher_suite_names.cc don't work. What should I enter to remove RC4 as a cipher for SSL/TLS?

I'm working with some different versions of GNU/Linux and sometimes also with Windows. So it would be nice if the command-line argument would work under all OSes. I used the following command:

chrome --cipher-suite-blacklist=TLS_RSA_WITH_RC4_128_MD5 --ssl-version-min=tls1.1
chrome --cipher-suite-blacklist=RC4 --ssl-version-min=tls1.1
chrome --cipher-suite-blacklist=0xXYZ,0xUVW --ssl-version-min=tls1.1  # XYZ and UVW are some hexadecimal numbers
share|improve this question
    
whats your OS? I assume you are trying commands from this page? code.google.com/p/chromium/issues/detail?id=58831 what was the exact command you entered? –  Frank Thomas Jul 8 '13 at 15:29
    
Yes, I try the commands from this page as well as the linked IANA page. –  qbi Jul 8 '13 at 19:17
    
what was your command exactly, and did you attempt to quote the argument containing the slash? –  Frank Thomas Jul 8 '13 at 19:55
    
I'm playing around with Google Chrome and also with Chromium and have to double-check if they both use the same command-line args. –  qbi Jul 8 '13 at 20:40

3 Answers 3

up vote 11 down vote accepted

You must inform the ciphers in hex based in RFC 2246 (http://www.ietf.org/rfc/rfc2246.txt).

The correct command line is:

 chrome --cipher-suite-blacklist=0x0004,0x0005,0xc011

No spaces between comma.

share|improve this answer
1  
This works, but I don't see from your link and answer how you decided to add the (necessary) option 0xc011. Could you please enlighten me? –  king_julien Oct 21 '13 at 15:39
2  
@gentmatt See iana.org/assignments/tls-parameters/… for a list of all cipher suites. You can ignore the anonymous, export, PSK and KRB5 cipher suites as they are not used. 0xC011 is TLS_ECDHE_RSA_WITH_RC4_128_SHA. Missing RC4 cipher suites in this list are 0xC002,0xC007,0xC00C. –  Lekensteyn Nov 9 '13 at 8:45

Tiago is right.

However, there are some more ciphers You may want to block: https://www.opensource.apple.com/source/Security/Security-55163.44/libsecurity_ssl/Security/CipherSuite.h?txt

Consequently, you should try this command line:

chrome --cipher-suite-blacklist=0x0001,0x0002,0x0004,0x0005,0x0017,0x0018,0xc002,0xc007,0xc00c,0xc011,0xc016,0xff80,0xff81,0xff82,0xff83

It should block all ciphers using RC4 and/or MD5.

share|improve this answer

TL;DR

You need to add the following parameter to block all RC4 ciphers (as of Chrome 31 in Ubuntu 12.04 with NSS 3.15)

--cipher-suite-blacklist=0x0004,0x0005,0xc011,0xc007

General Answer to figure it out yourself

The regularly updated list of all ciphers by IANA which user @Lekensteyn posted is already very helpful and definitely better than skimming some .txt files, but I have found an even easier way to...

  • check what ciphers your browser supports
  • get the hexadecimal value of the supported ciphers

Both information is provided directly in your browser by visiting the following website of the Leibniz University of Hannover:

In the picture below, the cipher indentifiers on are on the left side of the table. So, if I wanted to block the two ciphers RSA-AES-128-GCM-SHA256 and RSA-AES256-SHA I would look for (00,9c) and (00,35).

For Google Chrome this means that I have to add the parameter1:

--cipher-suite-blacklist=0x009c,0x0035 

enter image description here

__

1- In Google Chrome on Ubuntu you have to edit the file /usr/share/applications/google-chrome.desktop and add the parameter to each line that starts with Exec=/usr/bin/google-chrome-stable. There should be three overall.

Exec=/usr/bin/google-chrome-stable --cipher-suite-blacklist=0x009c,0x0035
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.