[openssl-users] [openssl-dev] Proposed cipher changes for post-1.0.2

[Michael Wojcik]

> From: openssl-users [mailto:openssl-users-bounces at openssl.org] On Behalf
> Of Salz, Rich
> Sent: Wednesday, February 11, 2015 10:47
> To: openssl-users at openssl.org; openssl-dev at openssl.org
> Subject: Re: [openssl-users] [openssl-dev] Proposed cipher changes for
> post-1.0.2
> 
> > I agree with Viktor. His suggestion (keep RC4 in MEDIUM, suppress it
> > explicilty in DEFAULT) is a good one that maintains important backward
> > compatibility while providing the desired removal of RC4 by default. There's
> > no advantage to moving RC4 to LOW.
> 
> Sure there is:  it's an accurate description of the quality of protection
> provided by the algorithm. :)

Hobgoblin consistency.

> It's also compatible with our documentation, which as was pointed out,
> always uses the word "currently" to describe the magic keywords.

Hobgoblins everywhere. And by that argument, any action is equally "compatible" with the documentation.

> And it's also planned for the next version which won't be available until near
> the end of the year.

I'm not sure why that's relevant.

> And it's also compliant with the expected publication of the IETF RFC's that
> talk about TLS configuration and attacks.

Frankly, that's rubbish. OpenSSL cipher lists are not "compliant" with RFCs because RFCs don't specify OpenSSL cipher lists. It's an entirely specious justification. And even if it weren't, explicitly disabling RC4 in the DEFAULT list would "comply" with the RFC.

> Postfix can work lay the groundwork to be future-compliant by changing its
> default configuration to be HIGH:MEDIUM:RC4.

All sorts of things can be done. Clearly, in the Brave New World of well-funded OpenSSL, they'll have to be, because it's apparent that we're going to see a lot of disruptive change made on the flimsiest of pretexts, with objections from the user community brushed aside. That's your prerogative, of course, and anyone's free to fork OpenSSL. But it's a shame.

-- 
Michael Wojcik
Technology Specialist, Micro Focus

 


This message has been scanned for malware by Websense. www.websense.com