From cd6a48fe6aaa173ba57f1726cbe88267617e70af Mon Sep 17 00:00:00 2001 From: yuhan6665 <1588741+yuhan6665@users.noreply.github.com> Date: Thu, 10 Sep 2026 22:34:17 -0400 Subject: [PATCH] crypto/tls: remove tlsrsakex GODEBUG setting Updates #75316 Change-Id: I6eb8482505a83b8b63edcb7d443e227a6a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/777381 Auto-Submit: Filippo Valsorda Reviewed-by: David Chase Reviewed-by: Roland Shoemaker LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com --- cipher_suites.go | 7 +------ common.go | 4 +--- defaults.go | 2 -- 3 files changed, 2 insertions(+), 11 deletions(-) diff --git a/cipher_suites.go b/cipher_suites.go index bc508fe..687acc4 100644 --- a/cipher_suites.go +++ b/cipher_suites.go @@ -343,16 +343,11 @@ var disabledCipherSuites = map[uint16]bool{ TLS_ECDHE_ECDSA_WITH_RC4_128_SHA: true, TLS_ECDHE_RSA_WITH_RC4_128_SHA: true, TLS_RSA_WITH_RC4_128_SHA: true, -} -// rsaKexCiphers contains the ciphers which use RSA based key exchange, -// which we also disable by default unless a GODEBUG is set. -var rsaKexCiphers = map[uint16]bool{ - TLS_RSA_WITH_RC4_128_SHA: true, + // RSA key exchange TLS_RSA_WITH_3DES_EDE_CBC_SHA: true, TLS_RSA_WITH_AES_128_CBC_SHA: true, TLS_RSA_WITH_AES_256_CBC_SHA: true, - TLS_RSA_WITH_AES_128_CBC_SHA256: true, TLS_RSA_WITH_AES_128_GCM_SHA256: true, TLS_RSA_WITH_AES_256_GCM_SHA384: true, } diff --git a/common.go b/common.go index 4b8aba8..0c594db 100644 --- a/common.go +++ b/common.go @@ -748,9 +748,7 @@ type Config struct { // the list is ignored. Note that TLS 1.3 ciphersuites are not configurable. // // If CipherSuites is nil, a safe default list is used. The default cipher - // suites might change over time. In Go 1.22 RSA key exchange based cipher - // suites were removed from the default list, but can be re-added with the - // GODEBUG setting tlsrsakex=1. In Go 1.23 3DES cipher suites were removed + // suites might change over time. In Go 1.23 3DES cipher suites were removed // from the default list, but can be re-added with the GODEBUG setting // tls3des=1. CipherSuites []uint16 diff --git a/defaults.go b/defaults.go index ee8f81b..5fb65f8 100644 --- a/defaults.go +++ b/defaults.go @@ -66,7 +66,6 @@ func defaultSupportedSignatureAlgorithms() []SignatureScheme { } } -//var tlsrsakex = godebug.New("tlsrsakex") //var tls3des = godebug.New("tls3des") func supportedCipherSuites(aesGCMPreferred bool) []uint16 { @@ -81,7 +80,6 @@ func defaultCipherSuites(aesGCMPreferred bool) []uint16 { cipherSuites := supportedCipherSuites(aesGCMPreferred) return slices.DeleteFunc(cipherSuites, func(c uint16) bool { return disabledCipherSuites[c] || - rsaKexCiphers[c] || tdesCiphers[c] }) }