[squid-users] Yet another new cipher?

[James Lay]

On 2016-06-30 07:18, James Lay wrote:
> On Fri, 2016-07-01 at 01:04 +1200, Amos Jeffries wrote:
> 
>> On 1/07/2016 12:43 a.m., James Lay wrote: On Wed, 2016-06-29 at
>> 19:33 -0600, James Lay wrote: Yugh...starting around 10:00 facebook
>> no longer works via peek/splice. pcap contents show:
>> 1QTV01...CHLO....SNI.....VERS....scontent.xx.fbcdn.netQTV1 after the
>> threeway handshake and an instant reset. Anyone know what this is?
>> Cause I haven't a clue....screenshot of success after bypassing
>> included. Thank you. I guess I should also say that this is from the
>> official Facebook app on Android...just updated on Tuesday.
>  FWIW: I identified the last one from your posted wireshark details.
> Looking at the "Unknown Ciphers:" list and looking up the hex codes
> listed there in the IANA registry. The details posted so far about
> this issue tells me nothing except that FB suddenly stopped working.
> Amos _______________________________________________ squid-users
> mailing list squid-users at lists.squid-cache.org
> http://lists.squid-cache.org/listinfo/squid-users [1]
> 
> That's fair...I'm including a successful handshake...wireshark just
> sees this as data.  Thanks Amos!
> 
> James
> 
> Links:
> ------
> [1] http://lists.squid-cache.org/listinfo/squid-users
> 
> _______________________________________________
> squid-users mailing list
> squid-users at lists.squid-cache.org
> http://lists.squid-cache.org/listinfo/squid-users


Meh...this is QUIC Crypto:

https://docs.google.com/document/d/1g5nIXAIkN_Y-7XJW5K45IblHd_L2f5LTaDUDwvZ5L6g/edit

James