Re: [TLS] The risk of misconfiguration

[Nikos Mavrogiannopoulos <[e-mail]>]

On Tue, 2014-05-06 at 11:48 -0700, Watson Ladd wrote:

> I've sort of singled out OpenSSL here. PolarSSL uses compile-time
> configuration, which in some circumstances doesn't work, but it at
> least provides a somewhat sensible configuration depending on how you
> build it.I've not looked at GnuTLS yet, or cryptlib.
[...]
> Actually configuring OpenSSL to do something reasonable requires
> writing something like
> EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:EECDH+RC4:RSA+RC4:!MD5.
> Good luck coming up with that when you are overly busy, don't realize
> that asking for high security doesn't actually do what you want, and
> don't know anything about crypto.

Just because you saw a red car you cannot infer that all cars are red.
As you describe it this clearly looks like an openssl problem and you
need to report to the openssl developers, not this list.

regards,
Nikos