Re: [sasl] MOGGIES Proposed Charter

[Nicolas Williams <[e-mail]>]

On Fri, May 21, 2010 at 06:43:35PM -0400, Tom Yu wrote:
> Yes, this means that you may have to revise the numeric "security
> strength" that you report for a given cryptographic association as new
> cryptanalytic attacks are discovered, but you would have to do that
> anyway with a non-numeric method of reporting "security strength".

Yes, but that way we get to also have policy names, both, standard and
locally-defined, as the interface _for users_.

Let me refine my problem with numeric measures of cryptographic strength
in APIs.  There are two.  First, what's better in a UI (I'm betting API
particulars will leak into UIs)?  Second, do we want to encourage users
and/or developers to make relative cipher suite strength comparisons?

Looking at it from a UI perspective I'd rather have UI-friendly security
strength indications than numeric ones.  One might argue that numeric
measures of strength are what users are used to, and there's no sense in
trying to change that.  Is anyone up for that argument?

Nico
--