Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I tested the latest Firefox beta using https://cc.dcsec.uni-hannover.de/ and all ciphers supported by Firefox 25 use MAC SHA1, none of them allow SHA-2. Can this be changed? Have Firefox plans to use SHA-2 in the future?

Beside, when I try to access a site that just support SHA-2 MACs, I got an error.

EDIT

I tested on Ubuntu 13.10 using ppa:mozillateam/firefox-next to have Firefox using NSS 3.15.1 and result the same, no SHA256 ciphers was available. Chrome (with >= NSS 3.15.1) and Opera work fine.

EDIT

I filed a bug to see if got some reply from Firefox developers, at support forum things are too quite.

share|improve this question

2 Answers 2

Cipher suites with HMACs using SHA-2 have been introduced in TLS 1.2. Currently, firefox only supports TLS 1.1. For more info on TLS 1.2 support, there is an open bug at mozilla's bugzilla (https://bugzilla.mozilla.org/show_bug.cgi?id=480514).

EDIT: As you noticed, the bug has been fixed at 25.0 beta. If you change the security.tls.version.max to 3 at the about:config page (it's in the link you provided) you can then visit https://www.ssllabs.com/ssltest/viewMyClient.html to test your client. At the bottom you will see that SHA-2 is supported.

share|improve this answer
    
Thanks for your reply @Fotis That bug have an status of RESOLVED FIXED. Pls, note that I'm talking about Firefox 25 beta. –  gsc-frank Oct 4 '13 at 23:39
    
Another reference –  gsc-frank Oct 4 '13 at 23:58
    
Isn't better to ask this at firefox / mozilla dev forum? –  Darius Oct 5 '13 at 7:54
    
Ops, I'm really sorry, I was interested in this too and I was under the impression that there was still no support. I had the link in my bookmarks and just pasted it. –  Fotis Oct 5 '13 at 8:07
    
I create a request/question in the Firefox support forum. –  gsc-frank Oct 5 '13 at 12:43
up vote 0 down vote accepted

As noted here Firefox community is not pushing in this direction, seem to me that HMAC with SHA-2 will not be an option.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.