Re: [TLS] Ala Carte Cipher suites - was: DSA should die

[Dave Garrett <[e-mail]>]

On Monday, April 13, 2015 11:02:13 pm Daniel Kahn Gillmor wrote:
> On Mon 2015-04-13 20:36:58 -0400, Viktor Dukhovni wrote:
> > So a key question is whether policies that rule out various corners
> > of the product space are legitimately required???
> 
> Here's one (granted, contrived) policy:
> 
>  * i'm willing to talk to US Government peers (they all want Suite B)
>    and Russian Government peers (they all want GOST).  so my policy is
>    that I want either an all-GOST collection or an all-suite-B
>    collection.  a la carte would suggest that i'd be OK with GOST key
>    agreement combined with suite B symmetric crypto, though i would not
>    consider that OK.

This scenario would be better served by a new extension that requests enforcement of specific sets of capabilities. The new proposals would make more unusual combinations negotiable, yes, but we are already in a situation where stuff from one can get negotiated in another. (e.g. authentication)

So long as things are properly configured and prioritized, this shouldn't be an issue. (e.g. prioritize all of set A before all of set B at both endpoints, and ensure both sets are complete)


Dave