diff --git a/quinn-proto/src/config.rs b/quinn-proto/src/config.rs index d1f401a2f..49a2346d0 100644 --- a/quinn-proto/src/config.rs +++ b/quinn-proto/src/config.rs @@ -533,7 +533,7 @@ impl ServerConfig { key: PrivateKey, ) -> Result { let mut crypto = rustls::ServerConfig::builder() - .with_cipher_suites(&crypto::rustls::QUIC_CIPHER_SUITES) + .with_safe_default_cipher_suites() .with_safe_default_kx_groups() .with_protocol_versions(&[&rustls::version::TLS13]) .unwrap() @@ -645,7 +645,7 @@ impl ClientConfig { fn new(roots: rustls::RootCertStore) -> Self { let mut cfg = rustls::ClientConfig::builder() - .with_cipher_suites(&crypto::rustls::QUIC_CIPHER_SUITES) + .with_safe_default_cipher_suites() .with_safe_default_kx_groups() .with_protocol_versions(&[&rustls::version::TLS13]) .unwrap() diff --git a/quinn-proto/src/crypto/rustls.rs b/quinn-proto/src/crypto/rustls.rs index f890a1020..b2040f3ff 100644 --- a/quinn-proto/src/crypto/rustls.rs +++ b/quinn-proto/src/crypto/rustls.rs @@ -350,17 +350,3 @@ impl crypto::PacketKey for PacketKey { self.integrity_limit() } } - -/// Cipher suites suitable for QUIC -/// -/// The list is equivalent to TLS1.3 ciphers. -/// It matches the rustls prefernce list that was introduced with -/// https://github.com/ctz/rustls/commit/7117a805e0104705da50259357d8effa7d599e37. -/// This list prefers AES ciphers, which are hardware accelerated on most platforms. -/// This list can be removed if the rustls dependency is updated to a new version -/// which contains the linked change. -pub(crate) static QUIC_CIPHER_SUITES: [rustls::SupportedCipherSuite; 3] = [ - rustls::cipher_suite::TLS13_AES_256_GCM_SHA384, - rustls::cipher_suite::TLS13_AES_128_GCM_SHA256, - rustls::cipher_suite::TLS13_CHACHA20_POLY1305_SHA256, -]; diff --git a/quinn-proto/src/tests/mod.rs b/quinn-proto/src/tests/mod.rs index 762f5bf84..166ae9f09 100644 --- a/quinn-proto/src/tests/mod.rs +++ b/quinn-proto/src/tests/mod.rs @@ -14,11 +14,8 @@ use rustls::internal::msgs::enums::AlertDescription; use tracing::info; use super::*; +use crate::cid_generator::{ConnectionIdGenerator, RandomConnectionIdGenerator}; use crate::crypto::Session as _; -use crate::{ - cid_generator::{ConnectionIdGenerator, RandomConnectionIdGenerator}, - crypto::rustls::QUIC_CIPHER_SUITES, -}; use crate::{Certificate, CertificateChain, PrivateKey}; mod util; use util::*; @@ -337,7 +334,7 @@ fn reject_missing_client_cert() { let cert = util::CERTIFICATE.serialize_der().unwrap(); let config = rustls::ServerConfig::builder() - .with_cipher_suites(&QUIC_CIPHER_SUITES) + .with_safe_default_cipher_suites() .with_safe_default_kx_groups() .with_protocol_versions(&[&rustls::version::TLS13]) .unwrap()