Re: cryptographic primitive choices [was: Re: Microsoft Warns Customers Away From RC4 and SHA-1]

[Seth Arnold <seth.arnold () canonical com>]

On Thu, Nov 14, 2013 at 11:58:47PM -0700, Kurt Seifried wrote:
> Think of all the things that currently use (often older versions of)
> OpenSSL/PolarSSL/GnuTLS/etc and will never get updated...

This is an argument for agressively assigning CVEs. If we're going to
have devices on our networks that are known to be a decade behind the
state of technology we should clearly label them as the security risk
they are. (TLS 1.2 is over five years old.)

Thanks

Attachment: signature.asc
Description: Digital signature