[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <5285C627.3040402@redhat.com>
Date: Thu, 14 Nov 2013 23:58:47 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: cryptographic primitive choices [was: Re: Microsoft
Warns Customers Away From RC4 and SHA-1]
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 11/14/2013 11:39 PM, Chris Palmer wrote:
> On Nov 14, 2013 9:31 PM, "Kurt Seifried" <kseifried@...hat.com>
> wrote:
>
>> So essentially in my head I see a couple slider bars, as they go
>> towards the riskier end of the spectrum (e.g. protecting a CA
>> certificate vs. protecting a single SSL session) stronger
>> encryption is needed.
>
> But the cost of setting the sliders all the way to the secure side
> is so low, why bother making the distinction?
Compatibility, for example HTTPS, you can disable a lot but if you
only allowed one cipher chances are a good chunk of clients wouldn't
be able to connect. There's a LOT of software out there, some open
source, some commercial, some written in house, it all uses encryption
and signing (usually wrongly, sigh) and a lot of it cannot or will not
be updated any time soon, if at all. Think of all the devices that act
as a web client and will never have TLS 1.2 support (e.g. "smart" TVs)
for example. Would I prefer the world to ditch SSL, TLS 1.0 and 1.1
and move to TLS 1.2 entirely? Of course. Is it going to happen? Not
for a loooong time.
Think of all the things that currently use (often older versions of)
OpenSSL/PolarSSL/GnuTLS/etc and will never get updated...
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.15 (GNU/Linux)
iQIcBAEBAgAGBQJShcYmAAoJEBYNRVNeJnmT5pUQAK0t3qhfhLw4zUBh0ac3qXgN
Nxoo22kz3VLDxNVRCzONnP8+R551uk0YW+7ylxGwgbfMt3RgpNT6gvfIPk/g+Z6V
bNo5iUDQPUJFGjy4xMPJ32NWz6+bYgcZwi7dBbfNBQZpJopsP3Q9iWAvvxh2w2Rn
G5+q8C7jF7FNRZnSf324h96VNhChdmh2rd6nGAanJl/kaQSPrTXMXF99EF04I9AO
x0YCu8nUDaD9l2oxBWRKfRDXNd3qJmO5xCk1eZJIaiPQiZW9z9JbjuODAqTIHhB2
OtPq+ATcrvj3uHUBqNQb9OhUOAkhEHPz7qkfdUskDj9/5c3qC/uNE9LBBVolVnTT
v+yL5QAcsPdyZk4xenlCSnEwguYWGG4VWYpxITazM9OSp6OxP+mAzprwOfPUVpRr
K0m5ARt3P54Xx4baOPExW7ukjCAknt19K7nyd4ZXUUQ3c2mNYGj87u23MJBtpdTL
8Xc+6nPNCdQ8OsdxykR12bmGGs6qqdc+3rQdXCzR6XlijCRi75iCkokGlipb+2MH
9SheIYSbZXkNTkQhXmZnZVgTizT9HF8RRAreVnWcBGngCSamCVPHXkaWsJfxGbdo
cWppbv109oOuCyXd2wraPqG+eRGBMNRQq2sGewTjLTI7Qe/b87CKn0nEiG4Xt1Ud
X7CpLJdIcrmYZ1OMqsP+
=hAuj
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
