[openssl-project] [openssl-dev] Blog post; changing in email, crypto policy, etc

[Andy Polyakov]

> There’s a new blog post at 
>     https://www.openssl.org/blog/blog/2018/01/18/f2f-london/

Quoting the blog post:

"Insecure configuration options will not be enabled by default but must
be enabled by a compile-time switch. We had already started to do this
by disabling SSLv2 and small keys. A recent change is that “multi-prime
RSA” will enforce a maximum number of prime factors by default. In the
future, it’s possible we’ll increase the minimum key sizes for a variety
of algorithms."

This is confusing. For starters it's mixing up two completely different
things. It's one thing to make availability of *legacy* crypto (or
protocol) an option, it's another thing to *introduce* insecure options.
Secondly, it gives an impression that maximum amount of primes in RSA is
a compile-time *option*, when it's not. Nor should it be. For above
reason, no new insecure option should be *introduced*. And there is
additional reason when it comes to assymetric crypto. As already said,
it's principally different from symmetric, as there are things that peer
can't verify in communication protocol and has to *trust* another party
with. And Open-source software is part of that trust chain. Now, does
wording mean that omc is actually open to suggestions to *introduce*
insecure options?