<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;"><span id="OLK_SRC_BODY_SECTION"><blockquote id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE" style="BORDER-LEFT: #b5c4df 5 solid; PADDING:0 0 0 5; MARGIN:0 0 0 5;"><div><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">So, if it’s “mandatory”, then it should be in the default set of ciphers, not necessarily the “HIGH” set.
<div class=""><br class=""></div><div class="">I’m selecting “HIGH” because I want 128-bit+ ciphers, not a cipher that that has subsequently found to be weaker than previously thought.</div></div></div></blockquote></span><div><br></div><div>I used to think that MTI doesn’t mean “Mandatory To Offer”. My codebase must have it, but my server (and/or client) configuration may explicitly forbid it. Is there anything wrong with this view?</div><div><br></div><div><br></div><div><br></div><span id="OLK_SRC_BODY_SECTION"><blockquote id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE" style="BORDER-LEFT: #b5c4df 5 solid; PADDING:0 0 0 5; MARGIN:0 0 0 5;"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div apple-content-edited="true" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">--</div><div class="">-Todd Short</div><div class="">// <a href="mailto:tshort@akamai.com" class="">tshort@akamai.com</a></div><div class="">// "One if by land, two if by sea, three if by the Internet."</div></div></div></div><br class=""><div><blockquote type="cite" class=""><div class="">On Feb 12, 2016, at 3:36 PM, Viktor Dukhovni <<a href="mailto:openssl-users@dukhovni.org" class="">openssl-users@dukhovni.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><br class=""><blockquote type="cite" class="">On Feb 12, 2016, at 3:15 PM, Salz, Rich <<a href="mailto:rsalz@akamai.com" class="">rsalz@akamai.com</a>> wrote:<br class=""><br class="">
So is RC4 and we don't see that as HIGH. HIGH implies strength, not MTI-ness.<br class=""></blockquote><br class="">
Now let's not make stuff up:<br class=""><br class=""><a href="http://tools.ietf.org/html/rfc5246#section-9" class="">http://tools.ietf.org/html/rfc5246#section-9</a><br class=""><br class="">
9. Mandatory Cipher Suites<br class=""><br class="">
In the absence of an application profile standard specifying<br class="">
otherwise, a TLS-compliant application MUST implement the cipher<br class="">
suite TLS_RSA_WITH_AES_128_CBC_SHA (see Appendix A.5 for the<br class="">
definition).<br class=""><br class="">
<a href="http://tools.ietf.org/html/rfc4346#section-9">http://tools.ietf.org/html/rfc4346#section-9</a><br class=""><br class="">
9. Mandatory Cipher Suites<br class=""><br class="">
In the absence of an application profile standard specifying<br class="">
otherwise, a TLS compliant application MUST implement the cipher<br class="">
suite TLS_RSA_WITH_3DES_EDE_CBC_SHA.<br class=""><br class="">
<a href="http://tools.ietf.org/html/rfc2246#section-9">http://tools.ietf.org/html/rfc2246#section-9</a><br class=""><br class="">
9. Mandatory Cipher Suites<br class=""><br class="">
In the absence of an application profile standard specifying<br class="">
otherwise, a TLS compliant application MUST implement the cipher<br class="">
suite TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA.<br class=""><br class="">
Since many users enable just HIGH ciphers, they must not exclude the MTI<br class="">
ciphers.<br class=""><br class="">
-- <br class="">
-- <br class=""><span class="Apple-tab-span" style="white-space:pre"></span>Viktor.<br class=""><br class="">
-- <br class="">
openssl-dev mailing list<br class="">
To unsubscribe: <a href="https://mta.openssl.org/mailman/listinfo/openssl-dev">https://mta.openssl.org/mailman/listinfo/openssl-dev</a><br class=""></div></blockquote></div><br class=""></div></blockquote></span></body></html>