From: Michael Kaply <345868+mkaply@users.noreply.github.com> Date: Thu, 10 Feb 2022 17:53:38 +0000 (-0500) Subject: Merge pull request #864 from mozilla/DisabledCiphers X-Git-Tag: v3.6~1 X-Git-Url: https://git.p6c8.net/policy-templates.git/commitdiff_plain/67b5d12193200ca100d976baad9d81a299bfd6e2?hp=8c1ad75b90f3b848aaf001e7f489980e8b427089 Merge pull request #864 from mozilla/DisabledCiphers Add new ciphers --- diff --git a/README.md b/README.md index cca3d27..b264068 100644 --- a/README.md +++ b/README.md @@ -1262,9 +1262,29 @@ Value (string): } ``` ### DisabledCiphers -Disable specific cryptographic ciphers. - -**Preferences Affected:** `security.ssl3.dhe_rsa_aes_128_sha`, `security.ssl3.dhe_rsa_aes_256_sha`, `security.ssl3.ecdhe_ecdsa_aes_128_gcm_sha256`, `security.ssl3.ecdhe_rsa_aes_128_gcm_sha256`, `security.ssl3.ecdhe_rsa_aes_128_sha`, `security.ssl3.ecdhe_rsa_aes_256_sha`, `security.ssl3.rsa_aes_128_gcm_sha256`, `security.ssl3.rsa_aes_128_sha`, `security.ssl3.rsa_aes_256_gcm_sha384`, `security.ssl3.rsa_aes_256_sha`, `security.ssl3.rsa_des_ede3_sha` +Disable specific cryptographic ciphers, listed below. + +``` +TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 +TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 +TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 +TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 +TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 +TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 +TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA +TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA +TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA +TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA +TLS_DHE_RSA_WITH_AES_128_CBC_SHA +TLS_DHE_RSA_WITH_AES_256_CBC_SHA +TLS_RSA_WITH_AES_128_GCM_SHA256 +TLS_RSA_WITH_AES_256_GCM_SHA384 +TLS_RSA_WITH_AES_128_CBC_SHA +TLS_RSA_WITH_AES_256_CBC_SHA +TLS_RSA_WITH_3DES_EDE_CBC_SHA +``` + +**Preferences Affected:** `security.ssl3.ecdhe_rsa_aes_128_gcm_sha256`, `security.ssl3.ecdhe_ecdsa_aes_128_gcm_sha256`, `security.ssl3.ecdhe_ecdsa_chacha20_poly1305_sha256`, `security.ssl3.ecdhe_rsa_chacha20_poly1305_sha256`, `security.ssl3.ecdhe_ecdsa_aes_256_gcm_sha384`, `security.ssl3.ecdhe_rsa_aes_256_gcm_sha384`, `security.ssl3.ecdhe_rsa_aes_128_sha`, `security.ssl3.ecdhe_ecdsa_aes_128_sha`, `security.ssl3.ecdhe_rsa_aes_256_sha`, `security.ssl3.ecdhe_ecdsa_aes_256_sha`, `security.ssl3.dhe_rsa_aes_128_sha`, `security.ssl3.dhe_rsa_aes_256_sha`, `security.ssl3.rsa_aes_128_gcm_sha256`, `security.ssl3.rsa_aes_256_gcm_sha384`, `security.ssl3.rsa_aes_128_sha`, `security.ssl3.rsa_aes_256_sha`, `security.ssl3.deprecated.rsa_des_ede3_sha` --- **Note:** @@ -1272,38 +1292,19 @@ Disable specific cryptographic ciphers. This policy was updated in Firefox 78 to allow enabling ciphers as well. Setting the value to true disables the cipher, setting the value to false enables the cipher. Previously setting the value to true or false disabled the cipher. --- -**Compatibility:** Firefox 76, Firefox ESR 68.8 (TLS_RSA_WITH_AES_128_GCM_SHA256 and TLS_RSA_WITH_AES_256_GCM_SHA384 were added in Firefox 78)\ +**Compatibility:** Firefox 76, Firefox ESR 68.8 (TLS_RSA_WITH_AES_128_GCM_SHA256 and TLS_RSA_WITH_AES_256_GCM_SHA384 were added in Firefox 78, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA38, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, and TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 were added in Firefox 97 and Firefox 91.6)\ **CCK2 Equivalent:** N/A\ **Preferences Affected:** N/A #### Windows (GPO) ``` -Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_DHE_RSA_WITH_AES_128_CBC_SHA = 0x1 | 0x0 -Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_DHE_RSA_WITH_AES_256_CBC_SHA = 0x1 | 0x0 -Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA = 0x1 | 0x0 -Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA = 0x1 | 0x0 -Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 = 0x1 | 0x0 -Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 = 0x1 | 0x0 -Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_RSA_WITH_AES_128_CBC_SHA = 0x1 | 0x0 -Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_RSA_WITH_AES_256_CBC_SHA = 0x1 | 0x0 -Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_RSA_WITH_3DES_EDE_CBC_SHA = 0x1 | 0x0 -Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_RSA_WITH_AES_128_GCM_SHA256 = 0x1 | 0x0 -Software\Policies\Mozilla\Firefox\DisabledCiphers\TLS_RSA_WITH_AES_256_GCM_SHA384 = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\DisabledCiphers\CIPHER_NAME = 0x1 | 0x0 ``` #### Windows (Intune) OMA-URI: ``` -./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_DHE_RSA_WITH_AES_128_CBC_SHA -./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_DHE_RSA_WITH_AES_256_CBC_SHA -./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA -./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA -./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 -./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 -./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_RSA_WITH_AES_128_CBC_SHA -./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_RSA_WITH_AES_256_CBC_SHA -./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_RSA_WITH_3DES_EDE_CBC_SHA -./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_RSA_WITH_AES_128_GCM_SHA256 -./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_TLS_RSA_WITH_AES_256_GCM_SHA384 +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DisabledCiphers/DisabledCiphers_CIPHER_NAME + ``` Value (string): ``` @@ -1314,27 +1315,7 @@ Value (string): DisabledCiphers - TLS_DHE_RSA_WITH_AES_128_CBC_SHA - | - TLS_DHE_RSA_WITH_AES_256_CBC_SHA - | - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - | - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA - | - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 - | - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 - | - TLS_RSA_WITH_AES_128_CBC_SHA - | - TLS_RSA_WITH_AES_256_CBC_SHA - | - TLS_RSA_WITH_3DES_EDE_CBC_SHA - | - TLS_RSA_WITH_AES_128_GCM_SHA256 - | - TLS_RSA_WITH_AES_256_GCM_SHA384 + CIPHER_NAME | @@ -1344,17 +1325,7 @@ Value (string): { "policies": { "DisabledCiphers": { - "TLS_DHE_RSA_WITH_AES_128_CBC_SHA": true | false, - "TLS_DHE_RSA_WITH_AES_256_CBC_SHA": true | false, - "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA": true | false, - "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA": true | false, - "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256": true | false, - "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256": true | false, - "TLS_RSA_WITH_AES_128_CBC_SHA": true | false, - "TLS_RSA_WITH_AES_256_CBC_SHA": true | false, - "TLS_RSA_WITH_3DES_EDE_CBC_SHA": true | false, - "TLS_RSA_WITH_AES_128_GCM_SHA256": true | false, - "TLS_RSA_WITH_AES_256_GCM_SHA384": true | false + "CIPHER_NAME": true | false, } } } diff --git a/windows/de-DE/firefox.adml b/windows/de-DE/firefox.adml index c3339c8..6a80eba 100644 --- a/windows/de-DE/firefox.adml +++ b/windows/de-DE/firefox.adml @@ -816,6 +816,12 @@ If this policy is disabled or not configured, onboarding messages will be shown TLS_RSA_WITH_3DES_EDE_CBC_SHA TLS_RSA_WITH_AES_128_GCM_SHA256 TLS_RSA_WITH_AES_256_GCM_SHA384 + TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA + TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA + TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 + TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 Wenn diese Richtlinieneinstellung aktiviert ist, ist der ausgewählte Cipher deaktiviert. Wenn diese Richtlinieneinstellung deaktiviert ist, ist der ausgewählte Cipher aktiviert. diff --git a/windows/en-US/firefox.adml b/windows/en-US/firefox.adml index 4a5b635..7a7c6be 100644 --- a/windows/en-US/firefox.adml +++ b/windows/en-US/firefox.adml @@ -816,6 +816,12 @@ If this policy is disabled or not configured, onboarding messages will be shown TLS_RSA_WITH_3DES_EDE_CBC_SHA TLS_RSA_WITH_AES_128_GCM_SHA256 TLS_RSA_WITH_AES_256_GCM_SHA384 + TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA + TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA + TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 + TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 If this policy is enabled, the corresponding cipher is disabled. If this policy is disabled, the corresponding cipher is enabled. diff --git a/windows/es-ES/firefox.adml b/windows/es-ES/firefox.adml index 0cf6e8e..f4b32c3 100644 --- a/windows/es-ES/firefox.adml +++ b/windows/es-ES/firefox.adml @@ -818,6 +818,12 @@ If this policy is disabled or not configured, onboarding messages will be shown TLS_RSA_WITH_3DES_EDE_CBC_SHA TLS_RSA_WITH_AES_128_GCM_SHA256 TLS_RSA_WITH_AES_256_GCM_SHA384 + TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA + TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA + TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 + TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 If this policy is enabled, the corresponding cipher is disabled. If this policy is disabled, the corresponding cipher is enabled. diff --git a/windows/firefox.admx b/windows/firefox.admx index 02628da..76db10d 100644 --- a/windows/firefox.admx +++ b/windows/firefox.admx @@ -3781,6 +3781,66 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/windows/fr-FR/firefox.adml b/windows/fr-FR/firefox.adml index 016c0f0..4fe1ab7 100644 --- a/windows/fr-FR/firefox.adml +++ b/windows/fr-FR/firefox.adml @@ -817,6 +817,12 @@ If this policy is disabled or not configured, onboarding messages will be shown TLS_RSA_WITH_3DES_EDE_CBC_SHA TLS_RSA_WITH_AES_128_GCM_SHA256 TLS_RSA_WITH_AES_256_GCM_SHA384 + TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA + TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA + TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 + TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 If this policy is enabled, the corresponding cipher is disabled. If this policy is disabled, the corresponding cipher is enabled. diff --git a/windows/it-IT/firefox.adml b/windows/it-IT/firefox.adml index 840044b..ed8d765 100644 --- a/windows/it-IT/firefox.adml +++ b/windows/it-IT/firefox.adml @@ -818,6 +818,12 @@ If this policy is disabled or not configured, onboarding messages will be shown TLS_RSA_WITH_3DES_EDE_CBC_SHA TLS_RSA_WITH_AES_128_GCM_SHA256 TLS_RSA_WITH_AES_256_GCM_SHA384 + TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA + TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA + TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 + TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 Se questo criterio è abilitato, il cifrario corrispondente è disabilitato. Se questo criterio è disabilitato, il cifrario corrispondente è abilitato. diff --git a/windows/ru-RU/firefox.adml b/windows/ru-RU/firefox.adml index b0d6fac..b522fa4 100644 --- a/windows/ru-RU/firefox.adml +++ b/windows/ru-RU/firefox.adml @@ -818,6 +818,12 @@ If this policy is disabled or not configured, onboarding messages will be shown TLS_RSA_WITH_3DES_EDE_CBC_SHA TLS_RSA_WITH_AES_128_GCM_SHA256 TLS_RSA_WITH_AES_256_GCM_SHA384 + TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA + TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA + TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 + TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 Если эта политика включена, соответствующий шифр отключен. Если эта политика отключена, соответствующий шифр включен. diff --git a/windows/zh-CN/firefox.adml b/windows/zh-CN/firefox.adml index c83d66f..542d37a 100644 --- a/windows/zh-CN/firefox.adml +++ b/windows/zh-CN/firefox.adml @@ -805,17 +805,23 @@ If this policy is not configured, Firefox will determine whether or not the home If this policy is enabled, onboarding messages will not be shown on the new tab page. If this policy is disabled or not configured, onboarding messages will be shown on the new tab page. - TLS_DHE_RSA_WITH_AES_128_CBC_SHA - TLS_DHE_RSA_WITH_AES_256_CBC_SHA - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 - TLS_RSA_WITH_AES_128_CBC_SHA - TLS_RSA_WITH_AES_256_CBC_SHA - TLS_RSA_WITH_3DES_EDE_CBC_SHA - TLS_RSA_WITH_AES_128_GCM_SHA256 - TLS_RSA_WITH_AES_256_GCM_SHA384 + TLS_DHE_RSA_WITH_AES_128_CBC_SHA + TLS_DHE_RSA_WITH_AES_256_CBC_SHA + TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA + TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA + TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + TLS_RSA_WITH_AES_128_CBC_SHA + TLS_RSA_WITH_AES_256_CBC_SHA + TLS_RSA_WITH_3DES_EDE_CBC_SHA + TLS_RSA_WITH_AES_128_GCM_SHA256 + TLS_RSA_WITH_AES_256_GCM_SHA384 + TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA + TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA + TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 + TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 若启用此原则，将禁用指定的加密套件组。 若禁用此原则，将只会开启指定的加密套件组。 diff --git a/windows/zh-TW/firefox.adml b/windows/zh-TW/firefox.adml index 0f5a285..63c1dee 100644 --- a/windows/zh-TW/firefox.adml +++ b/windows/zh-TW/firefox.adml @@ -816,6 +816,12 @@ If this policy is not configured or disabled, in private browsing, cookies are r TLS_RSA_WITH_3DES_EDE_CBC_SHA TLS_RSA_WITH_AES_128_GCM_SHA256 TLS_RSA_WITH_AES_256_GCM_SHA384 + TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA + TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA + TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 + TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 若啟用此原則，將停用指定的加密套件組。 若停用此原則，將只會開啟指定的加密套件組。