Re: [TLS] Unifying tickets and sessions

[Nico Williams <[e-mail]>]

On Wed, Oct 22, 2014 at 07:09:37PM +0000, Viktor Dukhovni wrote:
> On Wed, Oct 22, 2014 at 08:42:15PM +0200, Richard Fussenegger wrote:
> > Viktor Dukhovni already mentioned that
> > OpenSSL is actually supporting different key strengths, but for instance
> > nginx isn't exposing this setting to administrators.
> 
> For the record OpenSSL makes it possible for applications to use
> some other block cipher than aes-128-cbc, but this is not as easy
> as it sounds.  The application needs to register appropriate
> callbacks and take over key life-cycle management.  So simply using
> some other cipher-suite is not a trivial exercise, rather only once
> one is already managing key rotation via the callbacks, making the
> cipher configurable is trivial:

Polite words fail me.  (Not a reference to your code, Viktor.)

This sort of thing should be expressible in a much simpler way: as a
one-liner or with local configuration/policy.

Nico
--