<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=windows-1252">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 08/11/2015 00:04, Matt Caswell
wrote:<br>
</div>
<blockquote class=" cite" id="mid_563E8391_9020807_openssl_org"
cite="mid:563E8391.9020807@openssl.org" type="cite">
<pre wrap="">On 07/11/15 02:54, Viktor Dukhovni wrote:
</pre>
<blockquote class=" cite" id="Cite_2770568" type="cite">
<pre wrap="">On Fri, Nov 06, 2015 at 11:58:44PM +0000, Matt Caswell wrote:
</pre>
</blockquote>
<blockquote class=" cite" id="Cite_4746566" type="cite">
<blockquote class=" cite" id="Cite_9310355" type="cite">
<pre wrap="">OpenSSL selects the version it is going to use regardless of the
available ciphersuites. Only after selecting its version will the server
select the ciphersuite to use. If there aren't any compatible with the
selected version then it will fail with a "no shared cipher" error.
</pre>
</blockquote>
<pre wrap="">Will we always do that. I am not confident we can promise this,
but this is not at present about to change.
</pre>
</blockquote>
<pre wrap="">I think it is very unlikely to change for the currently available
released versions - and it is the behaviour of those versions that I am
describing. It could possibly change for future versions (as could
anything) - although I'm not aware of any plans to do so.
</pre>
</blockquote>
<tt>I have seen rumors (nothing reliable) that the TLS WG is
proposing <br>
to disable a whole lot of good cipher suites in TLS 1.3. If this
<br>
happens in the final spec, then some lists of enabled ciphers
would <br>
make TLS 1.2 the most secure choice even though TLS 1.3 is the <br>
highest shared version.</tt><tt><br>
</tt><br>
<tt>More specifically, they seem to deprecate the suites that use <br>
separate MAC and CRYPT keys in favor of AEAD suites that are <br>
designed very close to the margins of being secure.</tt><br>
<br>
<pre class="moz-signature" cols="72">Enjoy
Jakob
--
Jakob Bohm, CIO, Partner, WiseMo A/S. <a class="moz-txt-link-freetext" href="https://www.wisemo.com">https://www.wisemo.com</a>
Transformervej 29, 2860 Søborg, Denmark. Direct +45 31 13 16 10
This public discussion message is non-binding and may contain errors.
WiseMo - Remote Service Management for PCs, Phones and Embedded </pre>
</body>
</html>