Date: Tue, 5 Nov 2013 10:02:35 +0100 From: Stefan Bühler <stbuehler@...httpd.net> To: oss-security@...ts.openwall.com Subject: Re: openssl default ciphers On Mon, 04 Nov 2013 21:02:44 +0100 leToff <letoff@...il.com> wrote: > On 04/11/2013 20:40, Eric H. Christensen wrote: > > > > BEAST is now mitigated on most browsers so we can drop the very > > broken RC4 cipher. > I guess Stephan is working with Safari... > > leToff This is certainly not about which browser I am using, or what clients I have to support with my servers. Also the latest Safari versions support TLS1.2 (this itself doesn't mitigate BEAST on TLS1.0 connections, yes...) I didn't mention this in my first post: this is not only about setting a default cipher suite in a new software, but also about what I propose to dist maintainers to backport. So in my case (lighttpd SNI bug) I could add "HIGH:!aNULL@...ENGTH" as default cipher string in the patch fixing the SNI bug. Do you who voted so fast for dropping MEDIUM also vote for backporting such change to all long term support dists? In this case I think it would be better if instead openssl gets fixed to use "HIGH:!aNULL@...ENGTH" as default (including backporting this fix), fixing all applications using openssl at once. regards, Stefan Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.