Re: [TLS] Ala Carte Cipher suites - was: DSA should die

[Aaron Zauner <[e-mail]>]

Hi,

Dave Garrett wrote:
> (by the way, do we really want plain PSK?)

Added the PSK ciphersuites after lengthy discussion with nikos and peter
gutmann, they assure me it's of importance to the embedded world.


> Just splitting it into only two parts would avoid the risk of support holes you'd get with the full a la carte route.
> 
> There's plenty of space in the registry to keep adding piles and piles of variations for each suite, but I have seen actual instances where a server and client actually do support the same handshake and connection ciphers in TLS 1.2, but don't negotiate it because the specific combination isn't listed. The current system does lead to some support holes as-is.
> 

I actually really like the idea. But there're a couple of open questions
to that; What happens to existing ciphersuites? And given we switch to a
model of asymmetric and symmetric ciphersuites: (how) do we document all
the implicit ciphersuites that are defined once a new symmetric or
asymmetric algorithm is defined?

Aaron