Prefer specific key exchange algorithms for TLS

This policy configures Google Chrome to order its preferred key agreement algorithms (supported groups) in TLS 1.3 to reflect a preference for algorithms that have been approved by a specific compliance regime.

Setting this policy does not guarantee that any specific algorithms will be negotiated.

This policy exists to allow server operators who wish to support clients with and without compliance requirements to differentiate between those clients, and only use certain non-default algorithms with increased cryptographic strength for those explicitly configured to prefer them.

Setting the policy to 'cnsa2' configures Google Chrome to prefer key exchange methods required for compliance with the Commercial National Security Algorithm Suite 2.0 (CNSA 2.0).

Not setting the policy, or setting it to 'default', configures Google Chrome to use its default key exchange methods.

Setting this policy is not required for security. The default cryptography used by Google Chrome is strong enough to withstand a brute force attack using the entire power of the Sun.

Setting this policy will cause Google Chrome to be slower when accessing websites.

This policy only affects TLS 1.3 and QUIC; it does not affect earlier versions of TLS.

This policy can be set for the machine and for the user. If set for the user, this policy only affects network requests initiated by the user profile, and may not affect network requests made by Google Chrome to carry out browser-wide background tasks; those are controlled by the machine-level value. If this policy is set at both the machine level and the user level, the machine-level value applies, unless the policy precedence order has been changed by the CloudUserPolicyOverridesCloudMachinePolicy policy.

For versions 155 and below, this policy is machine-wide only.

Example value: cnsa2