oss-sec mailing list archives
Re: openssl default ciphers
From: Stefan Bühler <stbuehler () lighttpd net>
Date: Tue, 5 Nov 2013 10:02:35 +0100
On Mon, 04 Nov 2013 21:02:44 +0100 leToff <letoff () gmail com> wrote:
On 04/11/2013 20:40, Eric H. Christensen wrote:BEAST is now mitigated on most browsers so we can drop the very broken RC4 cipher.I guess Stephan is working with Safari... leToff
This is certainly not about which browser I am using, or what clients I have to support with my servers. Also the latest Safari versions support TLS1.2 (this itself doesn't mitigate BEAST on TLS1.0 connections, yes...) I didn't mention this in my first post: this is not only about setting a default cipher suite in a new software, but also about what I propose to dist maintainers to backport. So in my case (lighttpd SNI bug) I could add "HIGH:!aNULL@STRENGTH" as default cipher string in the patch fixing the SNI bug. Do you who voted so fast for dropping MEDIUM also vote for backporting such change to all long term support dists? In this case I think it would be better if instead openssl gets fixed to use "HIGH:!aNULL@STRENGTH" as default (including backporting this fix), fixing all applications using openssl at once. regards, Stefan
Attachment:
signature.asc
Description:
Current thread:
- openssl default ciphers Stefan Bühler (Nov 04)
- Re: openssl default ciphers Daniel Kahn Gillmor (Nov 04)
- Re: openssl default ciphers Eric H. Christensen (Nov 04)
- Re: openssl default ciphers Hanno Böck (Nov 04)
- Re: openssl default ciphers Russ Allbery (Nov 04)
- Re: openssl default ciphers Stefan Bühler (Nov 04)
- Re: openssl default ciphers Mike (Nov 04)
- Re: openssl default ciphers Eric H. Christensen (Nov 04)
- Re: openssl default ciphers leToff (Nov 04)
- Re: openssl default ciphers Stefan Bühler (Nov 05)
- Re: openssl default ciphers Florian Weimer (Nov 05)