Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When nowadays I point my browser to https sites, the cipher that is on most occasions used is Camellia. My browsers (Chrome and Firefox) seem to prefer it, even when AES is available.

Is that not kind of dangerous? Camellia did not receive so much scrutiny as did e.g. AES, so we know actually less about its security. Would it not be much better if AES was the default? I know I can change the cipher on Firefox, but it is not obvious how to do the same in Chrome.

share|improve this question
Personally - I've never seen Camellia in use in the wild. Could you post some links to sites which use it? (I'm curious). RC4 or AES seem to be the most common SSL algorithms these days. There's some discussion of Camellia here. – hunter Mar 1 '13 at 16:33
@hunter: for one – Jumbogram Mar 2 '13 at 14:16
@Jumbogram - yes, Yahoo is mentioned in the link that I posted. Still, that's the only one that I'm aware of. I certainly wouldn't say that Camellia is "widely used" (despite being a strong algorithm). – hunter Mar 2 '13 at 15:57
This is an example: As is almost any other austrian bank. – MKK Mar 4 '13 at 14:47
I just found out that Camellia is a EU recomended cipher:… So I guess it was kind of unfair to term it 'dangerous'. Sorry. – MKK Mar 7 '13 at 15:51
up vote 15 down vote accepted

The reason why you see that is because Camellia is the highest-preference cipher in NSS (Chrome and Firefox). Servers that support Camellia and use the client-preferred cipher suite will use Camellia.

NSS's rationale for this ordering is:

National ciphers such as Camellia are listed before international ciphers such as AES and RC4 to allow servers that prefer Camellia to be able to negotiate Camellia without having to disable AES and RC4, which are needed for interoperability with clients that don't yet implement Camellia.

See also: Bug 430875

share|improve this answer
"reason for NSS's ordering" makes little sense. A server preferring unusual ciphers can simply choose a cipher that's lower on the client's list. – CodesInChaos Mar 2 '13 at 14:05
@CodesInChaos: Indeed, this seems like a silly reason, given the existence of SSLHonorCipherOrder and similar options for other servers. Still, +1 to Jumbogram for figuring out the reason, even if it's silly. – Ilmari Karonen Mar 2 '13 at 19:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.