[Feature request] update Safari iOS and macOS handshake to v26

[drwetter]

I am curious whether Apple finally made a step toward PQC to catch up with all other major browser vendors with the release of version 26 of their operating systems. They lag behind since months:

As I am not willing to upgrade my devices yet, assistance would be much appreciated to upgrade the client handshakes.

Instructions are here: etc/client-simulation.wiresharked.md . Sending a pcap file from both safari browsers is also fine (grep SWCONTACT testssl.sh)

[cybniv]

For macOS with Safari Version 26.0.1 (21622.1.22.11.15), client hello hex stream (handshakebytes) would be

160301013901000135030397f677c846c4ff419b5554de2f84afe2ed490acb1f7659593efe9114408c71e8209973e4a1445657688ae1d665d702fa5a132481d69d7739fa1db01b9d758973960062130313021301cca9cca8ccaac030c02cc028c024c014c00a009f006b0039ff8500c400880081009d003d003500c00084c02fc02bc027c023c013c009009e0067003300be0045009c003c002f00ba0041c011c00700050004c012c0080016000a00ff0100008a002b0009080304030303020301003300260024001d00204c6a64454585c1e8a06672e2572595466f1c5d9baa1ea1af2e4ed0650f56505a0000000d000b0000086b6167692e636f6d000b00020100000a000a0008001d001700180019000d00180016080606010603080505010503080404010403020102030010000e000c02683208687474702f312e31

for Change Cipher Spec, I get this:

❯ ./utils/hexstream2cipher.sh 140303000101
# ciphers: 3
00: 1403 --> 0x14,0x03 -->
04: 0300 --> 0x03,0x00 --> RC2-CBC-MD5
08: 0101 --> 0x01,0x01 -->

RC2-CBC-MD5

https://tmpfiles.org/5801915/kagi_com.pcap

should the latter look like that?

[drwetter]

Thanks a lot @cybniv !

The handshakebytes and the thing below is not correct, probably you copied the wrong bytes.

I'll look into the pcap and figure out what happened.

[drwetter]

.. you can also sent the pcap to me if you want. I got a 404.