Table of Contents
How they work
The priority string is a list of components separated by colons.
Each component must be prefixed with
+ for adding it to or
! for removing it from the configuration (or the set it represents). Levels can only be set (no prefix) or added (with
+). Flags can only be set (all flags have a
NONE can only be specified as first component (without prefix), it represents an empty configuration. Otherwise it starts with a standard configuration containing no ciphers, key exchanges algorithms and hash algorithms.
The order of ciphers, key exchanges algorithms and hash algorithms matters for the order of the cipher suites; to generate the list it first iterates over key exchange algorithms, then ciphers, and then hash algorithms. New items are always added at the end of a list, so for example
SHA1 to the end of the hash algorithm list.
-ALL sets are not always representing the full list, but should at least contain the subset present in the
Version specific remarks
- Before GnuTLS 3.2.2 removing an algorithm didn’t preserve the order; instead the removed algorithm was replaced by the last algorithm in the list.
The fix to preserve ordering in GnuTLS 3.2.2 introduced another bug:
Also in tested versions so far (≤ 3.2.2) adding
-ALLsets removes all other algorithms in the list; if the
-ALLset actually contains all algorithms this only overwrites the order, but
COMP-DEFLATE. I consider this a bug for now, and therefore this behavior is not reflected on this page.
Levels can’t be removed, but adding levels actually appends the contained algorithms;
MD5as first hash algorithm.
GnuTLS 3.2.5 added a lot of new ciphersuites (many new combinations of already supported algorithms, and suites for the new
- (Not released yet): Camellia-GCM ciphers were added to some levels, GCM ciphers got higher priority (than comparable CBC) in default sets. These changes are already active below.
To actually check what your GnuTLS library is doing you can either run
gnutls-cli -l --priority="NORMAL" or download and compile gnutls-priority.c (which can show more internal state).