<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
So, if it’s “mandatory”, then it should be in the default set of ciphers, not necessarily the “HIGH” set.
<div class=""><br class="">
</div>
<div class="">I’m selecting “HIGH” because I want 128-bit+ ciphers, not a cipher that that has subsequently found to be weaker than previously thought.
<div class="">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
</div>
</div>
</div>
</div>
<div apple-content-edited="true" class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div class="">--</div>
<div class="">-Todd Short</div>
<div class="">// <a href="mailto:tshort@akamai.com" class="">tshort@akamai.com</a></div>
<div class="">// "One if by land, two if by sea, three if by the Internet."</div>
</div>
</div>
</div>
<br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Feb 12, 2016, at 3:36 PM, Viktor Dukhovni <<a href="mailto:openssl-users@dukhovni.org" class="">openssl-users@dukhovni.org</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class=""><br class="">
<blockquote type="cite" class="">On Feb 12, 2016, at 3:15 PM, Salz, Rich <<a href="mailto:rsalz@akamai.com" class="">rsalz@akamai.com</a>> wrote:<br class="">
<br class="">
So is RC4 and we don't see that as HIGH. HIGH implies strength, not MTI-ness.<br class="">
</blockquote>
<br class="">
Now let's not make stuff up:<br class="">
<br class="">
<a href="http://tools.ietf.org/html/rfc5246#section-9" class="">http://tools.ietf.org/html/rfc5246#section-9</a><br class="">
<br class="">
9. Mandatory Cipher Suites<br class="">
<br class="">
In the absence of an application profile standard specifying<br class="">
otherwise, a TLS-compliant application MUST implement the cipher<br class="">
suite TLS_RSA_WITH_AES_128_CBC_SHA (see Appendix A.5 for the<br class="">
definition).<br class="">
<br class="">
http://tools.ietf.org/html/rfc4346#section-9<br class="">
<br class="">
9. Mandatory Cipher Suites<br class="">
<br class="">
In the absence of an application profile standard specifying<br class="">
otherwise, a TLS compliant application MUST implement the cipher<br class="">
suite TLS_RSA_WITH_3DES_EDE_CBC_SHA.<br class="">
<br class="">
http://tools.ietf.org/html/rfc2246#section-9<br class="">
<br class="">
9. Mandatory Cipher Suites<br class="">
<br class="">
In the absence of an application profile standard specifying<br class="">
otherwise, a TLS compliant application MUST implement the cipher<br class="">
suite TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA.<br class="">
<br class="">
Since many users enable just HIGH ciphers, they must not exclude the MTI<br class="">
ciphers.<br class="">
<br class="">
-- <br class="">
-- <br class="">
<span class="Apple-tab-span" style="white-space:pre"></span>Viktor.<br class="">
<br class="">
-- <br class="">
openssl-dev mailing list<br class="">
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev<br class="">
</div>
</blockquote>
</div>
<br class="">
</body>
</html>